Test ID:	1.3.6.1.4.1.25623.1.0.881735
Category:	CentOS Local Security Checks
Title:	CentOS Update for libvirt CESA-2013:0831 centos6
Summary:	The remote host is missing an update for the 'libvirt'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'libvirt' package(s) announced via the referenced advisory. Vulnerability Insight: The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. It was found that libvirtd leaked file descriptors when listing all volumes for a particular pool. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to cause libvirtd to consume all available file descriptors, preventing other users from using libvirtd services (such as starting a new guest) until libvirtd is restarted. (CVE-2013-1962) Red Hat would like to thank Edoardo Comar of IBM for reporting this issue. This update also fixes the following bugs: * Previously, libvirt made control group (cgroup) requests on files that it should not have. With older kernels, such nonsensical cgroup requests were ignored. However, newer kernels are stricter, resulting in libvirt logging spurious warnings and failures to the libvirtd and audit logs. The audit log failures displayed by the ausearch tool were similar to the following: root [date] - failed cgroup allow path rw /dev/kqemu With this update, libvirt no longer attempts the nonsensical cgroup actions, leaving only valid attempts in the libvirtd and audit logs (making it easier to search for real cases of failure). (BZ#958837) * Previously, libvirt used the wrong variable when constructing audit messages. This led to invalid audit messages, causing ausearch to format certain entries as having path=(null)' instead of the correct path. This could prevent ausearch from locating events related to cgroup device ACL modifications for guests managed by libvirt. With this update, the audit messages are generated correctly, preventing loss of audit coverage. (BZ#958839) All users of libvirt are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, libvirtd will be restarted automatically. Affected Software/OS: libvirt on CentOS 6 Solution: Please install the updated packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1962 1028577 http://www.securitytracker.com/id/1028577 53440 http://secunia.com/advisories/53440 53475 http://secunia.com/advisories/53475 59937 http://www.securityfocus.com/bid/59937 93451 http://osvdb.org/93451 FEDORA-2013-8635 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106906.html FEDORA-2013-8681 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106921.html RHSA-2013:0831 http://rhn.redhat.com/errata/RHSA-2013-0831.html USN-1895-1 http://www.ubuntu.com/usn/USN-1895-1 [libvir-list] 20130516 [libvirt] [PATCH] daemon: fix leak after listing all volumes https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html [oss-security] 20130516 CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool http://www.openwall.com/lists/oss-security/2013/05/16/9 http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=ca697e90d5bd6a6dfb94bfb6d4438bdf9a44b739 https://bugzilla.redhat.com/show_bug.cgi?id=953107 libvirt-cve20131962-dos(84341) https://exchange.xforce.ibmcloud.com/vulnerabilities/84341 openSUSE-SU-2013:0885 http://lists.opensuse.org/opensuse-updates/2013-06/msg00022.html
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.