PT-2013-4999 · Red Hat+1 · Libvirt+1

Publicado 2013-11-02 · Atualizado 2024-06-15 · CVE-2013-4401

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvirt versions 1.1.0 through 1.1.3

Description The issue concerns the virConnectDomainXMLToNative API function, which incorrectly checks for the connect:read permission instead of the connect:write permission. This allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML.

Recommendations For libvirt versions 1.1.0 through 1.1.3, consider restricting access to the virConnectDomainXMLToNative API function until a patch is available. As a temporary workaround, review and limit the use of crafted XML to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2013-1059

CVE-2013-4401

OPENSUSE-SU-2024:10209-1

Produtos afetados

Alt Linux

Libvirt

Referências · 50

• https://suse.com/security/cve/CVE-2013-6456 · Nota
• https://suse.com/security/cve/CVE-2013-4153 · Nota
• https://suse.com/security/cve/CVE-2014-3657 · Nota
• https://osv.dev/vulnerability/CVE-2013-4401 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-1447 · Nota
• http://ubuntu.com/usn/USN-2026-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-6458 · Nota
• https://suse.com/security/cve/CVE-2015-5247 · Nota
• https://suse.com/security/cve/CVE-2013-4154 · Nota
• https://suse.com/security/cve/CVE-2013-2218 · Nota
• https://suse.com/security/cve/CVE-2014-0028 · Nota
• https://suse.com/security/cve/CVE-2014-3633 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10209-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-4399 · Nota
• https://suse.com/security/cve/CVE-2015-0236 · Nota