PT-2014-3438 · Red Hat+1 · Libvirt+1

Eric Blake · Publicado 2014-01-24 · Atualizado 2024-06-15 · CVE-2014-0028

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:A/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions libvirt versions 1.1.1 through 1.2.0

Description The issue allows context-dependent attackers to bypass restrictions in ACLs, specifically the domain:getattr and connect:search domains restrictions, and obtain sensitive domain object information. This is achieved via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.

Recommendations For libvirt versions 1.1.1 through 1.2.0, consider restricting access to the virConnectDomainEventRegister and virConnectDomainEventRegisterAny functions in the event registration API until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2014-1262

CVE-2014-0028

OPENSUSE-SU-2024:10209-1

Produtos afetados

Alt Linux

Libvirt

Referências · 52

• https://suse.com/security/cve/CVE-2013-6456 · Nota
• https://suse.com/security/cve/CVE-2013-4153 · Nota
• https://suse.com/security/cve/CVE-2014-3657 · Nota
• https://suse.com/security/cve/CVE-2011-2511 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6436 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1447 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-1447 · Nota
• http://ubuntu.com/usn/USN-2093-1 · Aviso do Fabricante
• https://redhat.com/archives/libvir-list/2014-January/msg00684.html · Nota
• https://suse.com/security/cve/CVE-2013-6458 · Nota
• https://suse.com/security/cve/CVE-2015-5247 · Nota
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-4154 · Nota
• https://errata.altlinux.org/ALT-PU-2014-1262 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-2218 · Nota