PT-2014-1857 · Red Hat+4 · Libvirt+5

Daniel P. Berrange + 1 · Published 2014-05-27 · Updated 2024-06-15 · CVE-2014-0179

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:A/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvirt versions 0.7.5 through 1.2.x before 1.2.5

Description The issue allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. This may lead to a disruption of confidentiality, integrity, and availability of protected information.

Recommendations For libvirt versions 0.7.5 through 1.2.x before 1.2.5, consider disabling the virConnectCompareCPU and virConnectBaselineCPU API methods as a temporary workaround until a patch is available. Restrict access to the API endpoints related to these methods to minimize the risk of exploitation. Avoid using crafted XML documents that contain XML external entity declarations in conjunction with entity references to these API methods until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-1702

BDU:2015-06824

BDU:2015-09111

CESA-2014_0560

CESA-2014_0914

CVE-2014-0179

DSA-3038-1

MGASA-2014-0243

OPENSUSE-SU-2024:10209-1

RHSA-2014:0560

RHSA-2014:0914

RHSA-2014_0560

RHSA-2014_0914

USN-2366-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Libvirt

References · 93

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5177 · Security Note
• https://bdu.fstec.ru/vul/2015-09111 · Security Note
• https://ubuntu.com/security/CVE-2014-3633 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0560.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09147 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0179 · Security Note
• https://bdu.fstec.ru/vul/2015-06012 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0179 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0179 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0179 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09148 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-0179 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1702 · Vendor Advisory
• http://ubuntu.com/usn/USN-2366-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06010 · Security Note