PT-2016-6216 · Red Hat+4 · Libvirt+5

Christoph Anton Mitterer + 1 · Published 2016-07-02 · Updated 2023-02-12 · CVE-2016-5008

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 2.0.0

Description The issue allows remote attackers to bypass authentication and establish a VNC session by connecting to the server when the password on a VNC server is set to an empty string.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider setting a non-empty password for the VNC server to prevent unauthorized access.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2016-1728

CESA-2016_2577

CVE-2016-5008

DLA-541-1

DSA-3613-1

MGASA-2016-0248

RHSA-2016:2577

RHSA-2016_2577

SUSE-SU-2016:1944-1

SUSE-SU-2016:2053-1

SUSE-SU-2016_1944-1

SUSE-SU-2016_2053-1

SUSE-SU-2018:2141-1

USN-3576-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Libvirt

References · 83

• http://lists.opensuse.org/opensuse-updates/2016-07/msg00054.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5313 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5160 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1728 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libvirt · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTQF6LXKEEMJG4VOOCIAPJAD6ACBYP4W · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1944-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5008 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5748 · Security Note
• http://lists.opensuse.org/opensuse-updates/2016-07/msg00055.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2141-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01492 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5008 · Security Note
• https://linux.oracle.com/errata/ELSA-2016-2577.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2577.html · Vendor Advisory