PT-2013-3502 · Qemu+3 · Qemu+3

Laszlo Ersek · Publicado 2013-05-21 · Atualizado 2024-06-15 · CVE-2013-2007

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qemu versions 1.4.1 and earlier

Description The issue concerns the qemu guest agent in Qemu, which is used by Xen. When the agent is started in daemon mode, it utilizes weak permissions for certain files. This weakness allows local users to read and write to these files.

Recommendations For Qemu versions 1.4.1 and earlier, consider restricting access to the affected files until a patch is available. As a temporary workaround, avoid running the qemu guest agent in daemon mode to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CESA-2013_0896

CVE-2013-2007

MGASA-2013-0169

OPENSUSE-SU-2024:10196-1

RHSA-2013:0896

RHSA-2013_0896

SUSE-SU-2013_1214-1

Produtos afetados

Centos

Qemu

Red Hat

Suse

Referências · 158

• https://suse.com/security/cve/CVE-2015-8554 · Nota
• https://suse.com/security/cve/CVE-2016-1922 · Nota
• https://suse.com/security/cve/CVE-2016-1714 · Nota
• https://suse.com/security/cve/CVE-2016-2271 · Nota
• https://suse.com/security/cve/CVE-2015-7835 · Nota
• https://access.redhat.com/errata/RHSA-2013:0896 · Nota
• https://suse.com/security/cve/CVE-2012-5525 · Nota
• https://suse.com/security/cve/CVE-2014-7815 · Nota
• https://advisories.mageia.org/MGASA-2013-0169.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-3124 · Nota
• http://secunia.com/advisories/53325 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2013-June/069250.html · Nota
• http://osvdb.org/93032 · Nota
• https://suse.com/security/cve/CVE-2015-8558 · Nota
• https://suse.com/security/cve/CVE-2013-1919 · Nota