Executive Summary
Summary | |
---|---|
Title | libvirt security and bug fix update |
Informations | |||
---|---|---|---|
Name | RHSA-2011:1197 | First vendor Publication | 2011-08-23 |
Vendor | RedHat | Last vendor Modification | 2011-08-23 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 4 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated libvirt packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems. An integer overflow flaw was found in libvirtd's RPC call handling. An attacker able to establish read-only connections to libvirtd could trigger this flaw by calling virDomainGetVcpus() with specially-crafted parameters, causing libvirtd to crash. (CVE-2011-2511) This update also fixes the following bugs: * Previously, when the "virsh vol-create-from" command was run on an LVM (Logical Volume Manager) storage pool, performance of the command was very low and the operation consumed an excessive amount of time. This bug has been fixed in the virStorageVolCreateXMLFrom() function, and the performance problem of the command no longer occurs. * Due to a regression, libvirt used undocumented command line options, instead of the recommended ones. Consequently, the qemu-img utility used an invalid argument while creating an encrypted volume, and the process eventually failed. With this update, the bug in the backing format of the storage back end has been fixed, and encrypted volumes can now be created as expected. (BZ#726617) * Due to a bug in the qemuAuditDisk() function, hot unplug failures were never audited, and a hot unplug success was audited as a failure. This bug has been fixed, and auditing of disk hot unplug operations now works as expected. (BZ#728516) * Previously, when a debug process was being activated, the act of preparing a debug message ended up with dereferencing a UUID (universally unique identifier) prior to the NULL argument check. Consequently, an API running the debug process sometimes terminated with a segmentation fault. With this update, a patch has been provided to address this issue, and the crashes no longer occur in the described scenario. (BZ#728546) * The libvirt library uses the "boot=on" option to mark which disk is bootable but it only uses that option if Qemu advertises its support. The qemu-kvm utility in Red Hat Enterprise Linux 6.1 removed support for that option and libvirt could not use it. As a consequence, when an IDE disk was added as the second storage with a virtio disk being set up as the first one by default, the operating system tried to boot from the IDE disk rather than the virtio disk and either failed to boot with the "No bootable disk" error message returned, or the system booted whatever operating system was on the IDE disk. With this update, the boot configuration is translated into bootindex, which provides control over which device is used for booting a guest operating system, thus fixing this bug. All users of libvirt are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, libvirtd must be restarted ("service libvirtd restart") for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 717199 - CVE-2011-2511 libvirt: integer overflow in VirDomainGetVcpus 726617 - libvirt regression with creating encrypted volume 728516 - Auditing of QEMU driver disk hotunplug events logs is missing and/or incorrect 728546 - [libvirt] [logs] null dereference while preparing libvirt logs |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2011-1197.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:13963 | |||
Oval ID: | oval:org.mitre.oval:def:13963 | ||
Title: | USN-1180-1 -- libvirt vulnerability | ||
Description: | libvirt: Libvirt virtualization toolkit An authenticated attacker could send crafted input to libvirt and cause it to crash. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1180-1 CVE-2011-2511 | Version: | 5 |
Platform(s): | Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 | Product(s): | libvirt |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21890 | |||
Oval ID: | oval:org.mitre.oval:def:21890 | ||
Title: | RHSA-2011:1019: libvirt security, bug fix, and enhancement update (Moderate) | ||
Description: | Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2011:1019-01 CESA-2011:1019 CVE-2011-2511 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | libvirt |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21894 | |||
Oval ID: | oval:org.mitre.oval:def:21894 | ||
Title: | RHSA-2011:1197: libvirt security and bug fix update (Moderate) | ||
Description: | Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2011:1197-01 CVE-2011-2511 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | libvirt |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23402 | |||
Oval ID: | oval:org.mitre.oval:def:23402 | ||
Title: | ELSA-2011:1019: libvirt security, bug fix, and enhancement update (Moderate) | ||
Description: | Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011:1019-01 CVE-2011-2511 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | libvirt |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23675 | |||
Oval ID: | oval:org.mitre.oval:def:23675 | ||
Title: | ELSA-2011:1197: libvirt security and bug fix update (Moderate) | ||
Description: | Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011:1197-01 CVE-2011-2511 | Version: | 6 |
Platform(s): | Oracle Linux 6 | Product(s): | libvirt |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:28011 | |||
Oval ID: | oval:org.mitre.oval:def:28011 | ||
Title: | DEPRECATED: ELSA-2011-1197 -- libvirt security and bug fix update (moderate) | ||
Description: | [0.8.7-18.0.1.el6_1.1 ] - Replace docs/et.png in tarball with blank image [libvirt-0.8.7-18.el6_1.1] - debug: Avoid null dereference on uuid lookup api (rhbz#728546) - Fix auditing of disk hotunplug operations (rhbz#728516) - storage: Fix regression with backing format (rhbz#726617) - Fix performance problem of virStorageVolCreateXMLFrom() (rhbz#715400) - qemu: Translate boot config into bootindex if possible (rhbz#715401) - remote: Protect against integer overflow (rhbz#717202) Resolves: rhbz#728546, rhbz#728516, rhbz#715400, rhbz#715401, rhbz#717202 Resolves: rhbz#726617 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011-1197 CVE-2011-2511 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | libvirt |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:28040 | |||
Oval ID: | oval:org.mitre.oval:def:28040 | ||
Title: | DEPRECATED: ELSA-2011-1019 -- libvirt security, bug fix, and enhancement update (moderate) | ||
Description: | [0.8.2-22.0.1.el5] - Replaced docs/et.png in tarball [libvirt-0.8.2-22.el5] - Fix auditing of disk hotunplug operations (rhbz#710151) [libvirt-0.8.2-21.el5] - remote: Protect against integer overflow (rhbz#717207) [0.8.2-20.el5] - Support enabling or disabling the HPET for Xen domains (rhbz#703193) - SMBIOS support (rhbz#661365) [0.8.2-19.el5] - xen: Plug memory leak in multiple serial ports support (rhbz#670789) - Manually kill gzip if restore fails before starting qemu (rhbz#681623) - qemu: Avoid double close on domain restore (rhbz#681623) - virterror: Avoid API breakage with vmware (rhbz#665075) - nwfilter: Resolve deadlock between VM ops and filter update (rhbz#697749) [0.8.2-18.el5] - xen: Prevent updating device when attaching a device (rhbz#662908) - Add PCI sysfs reset access (rhbz#689880) - xencapstest: Don't fail when Xen is installed (rhbz#690459) - Make error reporting in libvirtd thread safe (rhbz#690733) [0.8.2-17.el5] - Fix event-handling data race (rhbz#671569) - Add support for multiple serial ports into the Xen driver (rhbz#670789) - Add missing checks for read only connections (CVE-2011-1146) - Guess rhel macro based on dist macro (rhbz#665325) [0.8.2-16.el5] - Fix possible crash in virExec (rhbz#665549) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011-1019 CVE-2011-2511 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | libvirt |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-07-30 | Name : CentOS Update for libvirt CESA-2011:1019 centos5 x86_64 File : nvt/gb_CESA-2011_1019_libvirt_centos5_x86_64.nasl |
2012-07-09 | Name : RedHat Update for libvirt RHSA-2011:1197-01 File : nvt/gb_RHSA-2011_1197-01_libvirt.nasl |
2012-03-12 | Name : Gentoo Security Advisory GLSA 201202-07 (libvirt) File : nvt/glsa_201202_07.nasl |
2011-09-23 | Name : CentOS Update for libvirt CESA-2011:1019 centos5 i386 File : nvt/gb_CESA-2011_1019_libvirt_centos5_i386.nasl |
2011-08-03 | Name : Debian Security Advisory DSA 2280-1 (libvirt) File : nvt/deb_2280_1.nasl |
2011-08-02 | Name : Ubuntu Update for libvirt USN-1180-1 File : nvt/gb_ubuntu_USN_1180_1.nasl |
2011-07-27 | Name : Fedora Update for libvirt FEDORA-2011-9062 File : nvt/gb_fedora_2011_9062_libvirt_fc14.nasl |
2011-07-18 | Name : Fedora Update for libvirt FEDORA-2011-9091 File : nvt/gb_fedora_2011_9091_libvirt_fc15.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
73668 | libvirt src/libvirt.c virDomainGetVcpus() Function Request Parsing Remote Ove... |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-11-17 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2011-1090.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_libvirt-110706.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_libvirt-110706.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1197.nasl - Type : ACT_GATHER_INFO |
2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1019.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110721_libvirt_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110823_libvirt_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-02-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201202-07.nasl - Type : ACT_GATHER_INFO |
2011-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libvirt-7616.nasl - Type : ACT_GATHER_INFO |
2011-09-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1019.nasl - Type : ACT_GATHER_INFO |
2011-08-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1197.nasl - Type : ACT_GATHER_INFO |
2011-08-15 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libvirt-7613.nasl - Type : ACT_GATHER_INFO |
2011-07-29 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1180-1.nasl - Type : ACT_GATHER_INFO |
2011-07-27 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libvirt-110712.nasl - Type : ACT_GATHER_INFO |
2011-07-25 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9062.nasl - Type : ACT_GATHER_INFO |
2011-07-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2280.nasl - Type : ACT_GATHER_INFO |
2011-07-12 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9091.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:55:02 |
|