Test ID:	1.3.6.1.4.1.25623.1.0.703613
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3613-1)
Summary:	The remote host is missing an update for the Debian 'libvirt' package(s) announced via the DSA-3613-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'libvirt' package(s) announced via the DSA-3613-1 advisory. Vulnerability Insight: Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library. When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user to connect, despite the documentation declaring that setting an empty password for the VNC server prevents all client connections. With this update the behaviour is enforced by setting the password expiration to now. For the stable distribution (jessie), this problem has been fixed in version 1.2.9-9+deb8u3. For the unstable distribution (sid), this problem has been fixed in version 2.0.0-1. We recommend that you upgrade your libvirt packages. Affected Software/OS: 'libvirt' package(s) on Debian 8. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-5008 91562 http://www.securityfocus.com/bid/91562 DSA-3613 http://www.debian.org/security/2016/dsa-3613 FEDORA-2016-65cc608ebe https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZZMOMRXNPALA34XDF5NK363KDLAYSTL/ FEDORA-2016-7b7e16a39e https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTQF6LXKEEMJG4VOOCIAPJAD6ACBYP4W/ RHSA-2016:2577 http://rhn.redhat.com/errata/RHSA-2016-2577.html USN-3576-1 https://usn.ubuntu.com/3576-1/ http://security.libvirt.org/2016/0001.html https://bugzilla.redhat.com/show_bug.cgi?id=1180092 openSUSE-SU-2016:1809 http://lists.opensuse.org/opensuse-updates/2016-07/msg00054.html openSUSE-SU-2016:1810 http://lists.opensuse.org/opensuse-updates/2016-07/msg00055.html openSUSE-SU-2016:1975 http://lists.opensuse.org/opensuse-updates/2016-08/msg00024.html
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.