PT-2010-3836 · Red Hat · Libvirt+1

Petr Matousek · Publicado 2010-08-10 · Atualizado 2010-10-30 · CVE-2010-2239

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat libvirt versions 0.6.0 through 0.8.2

Description The issue allows guest OS users to read arbitrary files on the host OS. This is due to new images being created without setting the user-defined backing-store format. The exact vectors used for this are not specified.

Recommendations For versions 0.6.0 through 0.8.2, consider configuring the backing-store format manually to prevent guest OS users from reading arbitrary files on the host OS. As a temporary workaround, restrict access to sensitive files on the host OS to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-2239

RHSA-2010:0615

RHSA-2010_0615

Produtos afetados

Red Hat

Libvirt

Referências · 18

• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2010-2239 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-2242 · Nota
• http://vupen.com/english/advisories/2010/2763 · Nota
• http://vupen.com/english/advisories/2010/2062 · Nota
• http://redhat.com/support/errata/RHSA-2010-0615.html · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1008-1 · Aviso do Fabricante
• http://libvirt.org/news.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2239 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1008-2 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-2239 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=607812 · Nota
• https://access.redhat.com/errata/RHSA-2010:0615 · Nota
• http://ubuntu.com/usn/usn-1008-3 · Aviso do Fabricante