PT-2010-3836 · Red Hat · Libvirt+1

Petr Matousek · Published 2010-08-10 · Updated 2010-10-30 · CVE-2010-2239

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat libvirt versions 0.6.0 through 0.8.2

Description The issue allows guest OS users to read arbitrary files on the host OS. This is due to new images being created without setting the user-defined backing-store format. The exact vectors used for this are not specified.

Recommendations For versions 0.6.0 through 0.8.2, consider configuring the backing-store format manually to prevent guest OS users from reading arbitrary files on the host OS. As a temporary workaround, restrict access to sensitive files on the host OS to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2239

RHSA-2010:0615

RHSA-2010_0615

Affected Products

Red Hat

Libvirt

References · 18

• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2239 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0615.html · Vendor Advisory
• http://ubuntu.com/usn/usn-1008-1 · Vendor Advisory
• http://libvirt.org/news.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2239 · Vendor Advisory
• http://ubuntu.com/usn/usn-1008-2 · Vendor Advisory
• http://ubuntu.com/usn/usn-1008-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2239 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-2239 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2010-2242 · Note
• http://vupen.com/english/advisories/2010/2763 · Note
• http://vupen.com/english/advisories/2010/2062 · Note