PT-2013-3502 · Qemu+3 · Qemu+3

Laszlo Ersek · Published 2013-05-21 · Updated 2024-06-15 · CVE-2013-2007

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qemu versions 1.4.1 and earlier

Description The issue concerns the qemu guest agent in Qemu, which is used by Xen. When the agent is started in daemon mode, it utilizes weak permissions for certain files. This weakness allows local users to read and write to these files.

Recommendations For Qemu versions 1.4.1 and earlier, consider restricting access to the affected files until a patch is available. As a temporary workaround, avoid running the qemu guest agent in daemon mode to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2013_0896

CVE-2013-2007

MGASA-2013-0169

OPENSUSE-SU-2024:10196-1

RHSA-2013:0896

RHSA-2013_0896

SUSE-SU-2013_1214-1

Affected Products

Centos

Qemu

Red Hat

Suse

References · 158

• https://advisories.mageia.org/MGASA-2013-0169.html · Security Note
• http://secunia.com/advisories/53325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2007 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2007 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-0896.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00057.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0169 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0896.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0791.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2015-8554 · Note
• https://suse.com/security/cve/CVE-2016-1922 · Note
• https://suse.com/security/cve/CVE-2016-1714 · Note
• https://suse.com/security/cve/CVE-2016-2271 · Note
• https://suse.com/security/cve/CVE-2015-7835 · Note