PT-2013-6348 · Red Hat+2 · Libguestfs+3

Published 1970-01-01 · Updated 2024-06-15 · CVE-2013-4419

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:A/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libguestfs versions 1.20.12 and earlier libguestfs versions 1.22.7 and earlier

Description The issue affects the guestfish command in libguestfs, allowing local users to execute arbitrary commands by creating a temporary socket file in the /tmp/.guestfish-$UID/ directory. This can lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For libguestfs versions 1.20.12 and earlier, consider disabling the guestfish command until a patch is available. For libguestfs versions 1.22.7 and earlier, restrict access to the --remote and --listen options to minimize the risk of exploitation. Avoid using the --remote and --listen options in the affected guestfish command until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-04344

BDU:2015-04345

BDU:2015-04346

BDU:2015-04347

BDU:2015-04348

CESA-2013_1536

CVE-2013-4419

OPENSUSE-SU-2024:10032-1

RHSA-2013:1536

RHSA-2013_1536

SUSE-SU-2013_1626-1

Affected Products

Centos

Red Hat

Suse

Libguestfs

References · 34

• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4419 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04347 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1016960 · Patch
• https://bdu.fstec.ru/vul/2015-04344 · Security Note
• https://osv.dev/vulnerability/CVE-2013-4419 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4419 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-4419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4419 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-4419 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04348 · Security Note
• https://bdu.fstec.ru/vul/2015-04346 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-1536.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10032-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4419 · Vendor Advisory