PT-2008-6233 · Libvirt+1 · Libvirt+1

Daniel Berrange + 1 · Published 2008-12-19 · Updated 2024-06-15 · CVE-2008-5086

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvirt versions 0.3.2 through 0.5.1

Description The issue allows local users to bypass intended access restrictions and perform administrative actions due to multiple methods in libvirt not checking if a connection is read-only.

Recommendations For libvirt versions 0.3.2 through 0.5.1, consider restricting access to administrative actions until a patch is available. As a temporary workaround, review and enforce connection permissions to prevent unauthorized access.

Fix

Related Identifiers

CVE-2008-5086

OPENSUSE-SU-2024:11008-1

RHSA-2009:0382

RHSA-2009_0382

Affected Products

Red Hat

Libvirt

References · 46

• https://security-tracker.debian.org/tracker/CVE-2008-5086 · Vendor Advisory
• http://secunia.com/advisories/33217 · Vendor Advisory
• http://ubuntu.com/usn/usn-694-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• http://securityfocus.com/bid/32905 · Patch
• http://redhat.com/support/errata/RHSA-2009-0382.html · Vendor Advisory
• http://redhat.com/archives/fedora-package-announce/2008-December/msg00938.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5086 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-5086 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11008-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5086 · Security Note
• https://suse.com/security/cve/CVE-2020-25637 · Note
• https://suse.com/security/cve/CVE-2018-3639 · Note
• https://redhat.com/archives/libvir-list/2009-January/msg00726.html · Note
• https://suse.com/security/cve/CVE-2018-1064 · Note