Critical Cloudstack vulnerability discovered

The Apache Foundation and Citrix have warned of a criticial configuration vulnerability in the current version of the open source cloud infrastructure management software, CloudStack.

The vulnerability affects all versions of Cloudstack prior to October 7, including the Citrix commercial version.

The issue could allow execution of arbitrary Cloudstack API calls, such as deletion of all virtual machines in a system.

No known exploits have been released for the vulnerability.

Mitigation against the vulnerability is possible by logging into the Cloudstack MySQL database, disabling the system user and setting a random password.

Cloudstack is one of the largest open source cloud infrastructure management systems together with OpenStack and Eucalyptus. 

Incubated by the Apache Software foundation, Cloudstack counts over 50 large organisations such as Intel, BT, Alcatel-Lucent, ActiveState and Tata Communications among its technology partners.

In March this year, Citrix announced that it would abandon its OpenStack distribution in favour of the CloudStack operating system.