PT-2018-4212 · Parallels+1 · Vzkernel+1

Published 2014-06-25 · Updated 2018-02-27 · CVE-2014-3519

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions vzkernel versions prior to 042stab090.5

Description The issue is related to the open by handle at function in the vzkernel when using simfs. It might allow local container users with CAP DAC READ SEARCH capability to bypass an intended container protection mechanism. This could enable access to arbitrary files on a filesystem via vectors related to the use of the file handle structure.

Recommendations For vzkernel versions prior to 042stab090.5, update to version 042stab090.5 or later to resolve the issue. As a temporary workaround, consider restricting the CAP DAC READ SEARCH capability for local container users to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2014-1817

CVE-2014-3519

Affected Products

Alt Linux

Vzkernel

References · 10

• https://errata.altlinux.org/ALT-PU-2014-1817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3519 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3519 · Security Note
• https://help.virtuozzo.com/customer/en/portal/articles/2563843-cu-2-6-32-042stab090-5-parallels-server-bare-metal-5-0-core-update · Vendor Advisory
• https://help.virtuozzo.com/customer/en/portal/articles/2522783-parallels-cloud-server-6-0-update-6-hotfix-8-6-0-6-2004- · Vendor Advisory
• https://openvz.org/Download/kernel/rhel6/042stab090.5 · Vendor Advisory
• https://help.virtuozzo.com/customer/en/portal/articles/2563842-cu-2-6-32-042stab090-5-parallels-virtuozzo-containers-4-7-core-update · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/06/24/16 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2014-3519 · Note
• http://securityfocus.com/bid/68171 · Note