PT-2014-3438 · Red Hat+1 · Libvirt+1

Eric Blake · Published 2014-01-24 · Updated 2024-06-15 · CVE-2014-0028

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:A/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions libvirt versions 1.1.1 through 1.2.0

Description The issue allows context-dependent attackers to bypass restrictions in ACLs, specifically the domain:getattr and connect:search domains restrictions, and obtain sensitive domain object information. This is achieved via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.

Recommendations For libvirt versions 1.1.1 through 1.2.0, consider restricting access to the virConnectDomainEventRegister and virConnectDomainEventRegisterAny functions in the event registration API until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-1262

CVE-2014-0028

OPENSUSE-SU-2024:10209-1

Affected Products

Alt Linux

Libvirt

References · 52

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6436 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1447 · Security Note
• http://ubuntu.com/usn/USN-2093-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1262 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0028 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10209-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0028 · Security Note
• https://osv.dev/vulnerability/CVE-2014-0028 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1048637 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6456 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-0028 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6457 · Security Note
• http://security.gentoo.org/glsa/glsa-201412-04.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0028 · Security Note