Test ID:	1.3.6.1.4.1.25623.1.0.840680
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-1152-1)
Summary:	The remote host is missing an update for the 'libvirt' package(s) announced via the USN-1152-1 advisory.
Description:	Summary: The remote host is missing an update for the 'libvirt' package(s) announced via the USN-1152-1 advisory. Vulnerability Insight: It was discovered that libvirt did not use thread-safe error reporting. A remote attacker could exploit this to cause a denial of service via application crash. (CVE-2011-1486) Eric Blake discovered that libvirt had an off-by-one error which could be used to reopen disk probing and bypass the fix for CVE-2010-2238. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 11.04. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2011-2178) Affected Software/OS: 'libvirt' package(s) on Ubuntu 10.04, Ubuntu 10.10, Ubuntu 11.04. Solution: Please install the updated package(s). CVSS Score: 4.4 CVSS Vector: AV:L/AC:M/Au:S/C:C/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1486 1025477 http://securitytracker.com/id?1025477 44459 http://secunia.com/advisories/44459 47148 http://www.securityfocus.com/bid/47148 DSA-2280 http://www.debian.org/security/2011/dsa-2280 RHSA-2011:0478 http://www.redhat.com/support/errata/RHSA-2011-0478.html RHSA-2011:0479 http://www.redhat.com/support/errata/RHSA-2011-0479.html USN-1152-1 http://www.ubuntu.com/usn/USN-1152-1 [libvirt] 20110323 [PATCH] Make error reporting in libvirtd thread safe https://www.redhat.com/archives/libvir-list/2011-March/msg01087.html http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=f44bfb7fb978c9313ce050a1c4149bf04aa0a670 http://support.avaya.com/css/P8/documents/100134583 https://bugzilla.redhat.com/show_bug.cgi?id=693391 Common Vulnerability Exposure (CVE) ID: CVE-2011-2178 FEDORA-2011-9091 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062515.html [libvirt] 20110531 [PATCH] security: plug regression introduced in disk probe logic https://www.redhat.com/archives/libvir-list/2011-May/msg01935.html http://libvirt.org/news.html http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-2178.html https://bugzilla.redhat.com/show_bug.cgi?id=709769 https://bugzilla.redhat.com/show_bug.cgi?id=709775 openSUSE-SU-2011:0643 http://lists.opensuse.org/opensuse-updates/2011-06/msg00030.html
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.