Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.63586
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2009:0382
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2009:0382.

libvirt is a C API for managing and interacting with the virtualization
capabilities of Linux and other operating systems. libvirt also provides
tools for remotely managing virtualized systems.

The libvirtd daemon was discovered to not properly check user connection
permissions before performing certain privileged actions, such as
requesting migration of an unprivileged guest domain to another system. A
local user able to establish a read-only connection to libvirtd could use
this flaw to perform actions that should be restricted to read-write
connections. (CVE-2008-5086)

libvirt_proxy, a setuid helper application allowing non-privileged users to
communicate with the hypervisor, was discovered to not properly validate
user requests. Local users could use this flaw to cause a stack-based
buffer overflow in libvirt_proxy, possibly allowing them to run arbitrary
code with root privileges. (CVE-2009-0036)

All users are advised to upgrade to these updated packages, which contain
backported patches which resolve these issues. After installing the update,
libvirtd must be restarted manually (for example, by issuing a
service libvirtd restart command) for this change to take effect.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2009-0382.html
http://www.redhat.com/security/updates/classification/#moderate

CVSS Score:
7.2

CVSS Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2008-5086
BugTraq ID: 32905
http://www.securityfocus.com/bid/32905
http://www.redhat.com/archives/fedora-package-announce/2008-December/msg00938.html
https://www.redhat.com/archives/libvir-list/2008-December/msg00522.html
http://osvdb.org/50919
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8765
http://www.redhat.com/support/errata/RHSA-2009-0382.html
http://secunia.com/advisories/33198
http://secunia.com/advisories/33217
http://secunia.com/advisories/33292
http://secunia.com/advisories/34397
SuSE Security Announcement: SUSE-SR:2009:004 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://www.ubuntu.com/usn/usn-694-1
Common Vulnerability Exposure (CVE) ID: CVE-2009-0036
BugTraq ID: 33724
http://www.securityfocus.com/bid/33724
https://www.redhat.com/archives/libvir-list/2009-January/msg00699.html
https://www.redhat.com/archives/libvir-list/2009-January/msg00726.html
https://www.redhat.com/archives/libvir-list/2009-January/msg00728.html
http://openwall.com/lists/oss-security/2009/02/10/8
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10127
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.