PT-2014-6316 · Libvirt+4 · Libvirt+4

Daniel P. Berrange + 1 · Published 2014-06-02 · Updated 2019-04-22 · CVE-2014-5177

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions libvirt versions 1.0.0 through 1.2.x before 1.2.5

Description The issue allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to various API methods, including virDomainDefineXML, virNetworkCreateXML, virNetworkDefineXML, virStoragePoolCreateXML, virStoragePoolDefineXML, virStorageVolCreateXML, virDomainCreateXML, virNodeDeviceCreateXML, virInterfaceDefineXML, virStorageVolCreateXMLFrom, virConnectDomainXMLFromNative, virConnectDomainXMLToNative, virSecretDefineXML, virNWFilterDefineXML, virDomainSnapshotCreateXML, virDomainSaveImageDefineXML, virDomainCreateXMLWithFiles, virConnectCompareCPU, or virConnectBaselineCPU. This is related to an XML External Entity (XXE) issue.

Recommendations For libvirt versions 1.0.0 through 1.2.x before 1.2.5, consider disabling the fine grained access control feature until a patch is available. Restrict access to the API methods listed above to minimize the risk of exploitation. Avoid using crafted XML documents that contain XML external entity declarations.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-1702

CESA-2014_0914

CVE-2014-5177

RHSA-2014:0914

RHSA-2014_0914

USN-2366-1

Affected Products

Alt Linux

Centos

Red Hat

Ubuntu

Libvirt

References · 43

• https://ubuntu.com/security/CVE-2014-5177 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5177 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3633 · Security Note
• https://bdu.fstec.ru/vul/2015-09111 · Security Note
• https://bdu.fstec.ru/vul/2015-09149 · Security Note
• https://ubuntu.com/security/notices/USN-2366-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3633 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09147 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0179 · Security Note
• https://bdu.fstec.ru/vul/2015-06824 · Security Note
• https://bdu.fstec.ru/vul/2015-06012 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-5177 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06009 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-5177 · Security Note