Executive Summary
Summary | |
---|---|
Title | libvirt vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-2867-1 | First vendor Publication | 2016-01-12 |
Vendor | Ubuntu | Last vendor Modification | 2016-01-12 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in libvirt. Software Description: - libvirt: Libvirt virtualization toolkit Details: It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon was restarted. This could result in an unintended firewall configuration. This issue only applied to Ubuntu 12.04 LTS. (CVE-2011-4600) Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136) Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-0236) Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-5247) Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: Ubuntu 15.04: Ubuntu 14.04 LTS: Ubuntu 12.04 LTS: After a standard system update you need to reboot your computer to make all the necessary changes. References: Package Information: |
Original Source
Url : http://www.ubuntu.com/usn/USN-2867-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
40 % | CWE-284 | Access Control (Authorization) Issues |
20 % | CWE-264 | Permissions, Privileges, and Access Controls |
20 % | CWE-200 | Information Exposure |
20 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-10-19 | Name : Fedora Update for libvirt FEDORA-2012-15640 File : nvt/gb_fedora_2012_15640_libvirt_fc16.nasl |
2012-08-24 | Name : Fedora Update for libvirt FEDORA-2012-11843 File : nvt/gb_fedora_2012_11843_libvirt_fc16.nasl |
2012-04-02 | Name : Fedora Update for libvirt FEDORA-2011-17267 File : nvt/gb_fedora_2011_17267_libvirt_fc16.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
78232 | libvirt bridge Forward Mode Firewall Port Access Restriction Weakness |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-12-15 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20161103_libvirt_on_SL7_x.nasl - Type : ACT_GATHER_INFO |
2016-12-05 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201612-10.nasl - Type : ACT_GATHER_INFO |
2016-11-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2577.nasl - Type : ACT_GATHER_INFO |
2016-11-11 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2577.nasl - Type : ACT_GATHER_INFO |
2016-11-04 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2577.nasl - Type : ACT_GATHER_INFO |
2016-04-05 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-0931-1.nasl - Type : ACT_GATHER_INFO |
2016-04-01 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-0923-1.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote Fedora host is missing a security update. File : fedora_2015-30b347dff1.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote Fedora host is missing a security update. File : fedora_2015-2c9678da8c.nasl - Type : ACT_GATHER_INFO |
2016-02-03 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-0304-1.nasl - Type : ACT_GATHER_INFO |
2016-01-27 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-82.nasl - Type : ACT_GATHER_INFO |
2016-01-26 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-77.nasl - Type : ACT_GATHER_INFO |
2016-01-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2867-1.nasl - Type : ACT_GATHER_INFO |
2015-12-21 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_f714b4c9a6c111e588d7047d7b492d07.nasl - Type : ACT_GATHER_INFO |
2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-115.nasl - Type : ACT_GATHER_INFO |
2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-070.nasl - Type : ACT_GATHER_INFO |
2015-03-26 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150305_libvirt_on_SL7_x.nasl - Type : ACT_GATHER_INFO |
2015-03-18 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0323.nasl - Type : ACT_GATHER_INFO |
2015-03-13 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0323.nasl - Type : ACT_GATHER_INFO |
2015-03-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0323.nasl - Type : ACT_GATHER_INFO |
2015-02-18 | Name : The remote Fedora host is missing a security update. File : fedora_2015-1883.nasl - Type : ACT_GATHER_INFO |
2015-02-16 | Name : The remote Fedora host is missing a security update. File : fedora_2015-1892.nasl - Type : ACT_GATHER_INFO |
2015-02-09 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-112.nasl - Type : ACT_GATHER_INFO |
2015-02-09 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-035.nasl - Type : ACT_GATHER_INFO |
2015-01-16 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-023.nasl - Type : ACT_GATHER_INFO |
2015-01-05 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-3.nasl - Type : ACT_GATHER_INFO |
2015-01-05 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-2.nasl - Type : ACT_GATHER_INFO |
2014-12-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-36.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-78.nasl - Type : ACT_GATHER_INFO |
2012-01-06 | Name : The remote Fedora host is missing a security update. File : fedora_2011-17267.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-04-19 00:28:47 |
|
2016-04-14 21:30:33 |
|
2016-04-12 05:37:11 |
|
2016-01-14 13:26:25 |
|
2016-01-12 21:23:11 |
|