PT-2016-6216 · Red Hat+4 · Libvirt+5

Christoph Anton Mitterer + 1 · Publicado 2016-07-02 · Atualizado 2023-02-12 · CVE-2016-5008

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 2.0.0

Description The issue allows remote attackers to bypass authentication and establish a VNC session by connecting to the server when the password on a VNC server is set to an empty string.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider setting a non-empty password for the VNC server to prevent unauthorized access.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2016-1728

CESA-2016_2577

CVE-2016-5008

DLA-541-1

DSA-3613-1

MGASA-2016-0248

RHSA-2016:2577

RHSA-2016_2577

SUSE-SU-2016:1944-1

SUSE-SU-2016:2053-1

SUSE-SU-2016_1944-1

SUSE-SU-2016_2053-1

SUSE-SU-2018:2141-1

USN-3576-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Libvirt

Referências · 83

• https://bugzilla.suse.com/987527 · Nota
• http://lists.opensuse.org/opensuse-updates/2016-07/msg00054.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5313 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5160 · Nota de Segurança
• http://securityfocus.com/bid/91562 · Nota
• https://errata.altlinux.org/ALT-PU-2016-1728 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2015-5313 · Nota
• https://security-tracker.debian.org/tracker/source-package/libvirt · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-5008.html · Nota
• https://bugzilla.suse.com/970906 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTQF6LXKEEMJG4VOOCIAPJAD6ACBYP4W · Aviso do Fabricante
• https://bugzilla.suse.com/968483 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:1944-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5008 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-5008 · Nota