libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0586 advisory.

    [1.7.17-17]
    - Remove dependency on gfs2-utils.
      resolves: rhbz#695138

    [1.7.17-16]
    - Canonicalize /dev/vd* paths in virt-inspector code.
      resolves: rhbz#691724

    [1.7.17-15]
    - Fix trace segfault for non-daemon functions.
      resolves: rhbz#676788

    [1.7.17-14]
    - Add explicit BuildRequires for latest augeas. (RHBZ#677616)

    [1.7.17-13]
    - Rebuild to pick up new augeas lens (RHBZ#677616)

    [1.7.17-12]
    - Fix typo in virt-make-fs manual page.
      resolves: rhbz#673721
    - Add a grep-friendly string to LIBGUESTFS_TRACE output.
      resolves: rhbz#673477

    [1.7.17-11]
    - Only runtime require febootstrap-supermin-helper (not whole of       febootstrap) (RHBZ#669840).

    [1.7.17-10]
    - Remove external hexedit script and make guestfish users set .
      This is because requiring emacs pulls in all of X (RHBZ#641494).

    [1.7.17-9]
    - Fix: guestfish fails when guest fstab entry does not exist (RHBZ#668611).

    [1.7.17-8]
    - Backport patches up to upstream 1.8.1. (RHBZ#613593)
    - Fixes:
       * guestfish: fails to tilde expand '~' when /home/ksharma unset (RHBZ#617440)
       * libguestfs: unknown filesystem /dev/fd0 (RHBZ#666577)
       * libguestfs: unknown filesystem label SWAP-sda2 (RHBZ#666578)
       * libguestfs: unknown filesystem /dev/hd{x} (cdrom) (RHBZ#666579)
       * virt-filesystems fails on guest with corrupt filesystem label (RHBZ#668115)
       * emphasize 'libguestfs-winsupport' in error output (RHBZ#627468)

    [1.7.17-4]
    - Backport patches up to upstream 1.8.0 _except_ for:
       * changes which require febootstrap 3.x
       * changes which were only relevant for other distros

    [1.7.17-3]
    - New upstream version 1.7.17, rebase for RHEL 6.1 (RHBZ#613593).
    - Require febootstrap >= 2.11.
    - Split out new libguestfs-tools-c package from libguestfs-tools.
      . This is so that the -tools-c package can be pulled in by people         wanting to avoid a dependency on Perl, while -tools pulls in everything         as before.
      . The C tools currently are: cat, df, filesystems, fish, inspector, ls,         mount, rescue.
      . libguestfs-tools no longer pulls in guestfish.
    - guestfish no longer requires pod2text, hence no longer requires perl.
    - guestfish also depends on: less, man, vi, emacs.
    - Add BR db4-utils (although since RPM needs it, it not really necessary).
    - Runtime requires on db4-utils should be on core lib, not tools package.
    - Change all 'Requires: perl-Foo' to 'Requires: perl(Foo)'.
    - New manual pages containing example code.
    - Ship examples for C, OCaml, Ruby, Python.
    - Don't ship HTML versions of man pages.
    - Rebase no-fuse-test patch to latest version.
    - New tool: virt-filesystems.
    - Rename perl-libguestfs as perl-Sys-Guestfs (RHBZ#652587).
    - Remove guestfs-actions.h and guestfs-structs.h.  Libguestfs now     [header file.]
    - Add AUTHORS file from tarball.

    [1.6.2-4]
    - New upstream stable version 1.6.2, rebase for RHEL 6.1 (RHBZ#613593).
    - Remove previous patches which are now all upstream and in this new version.
    - BR febootstrap 2.10 (RHBZ#628849).
    - BR cryptsetup-luks for new LUKS encryption support.
    - ocaml-xml-light{,-devel} is no longer required to build.
    - guestfish is no longer dependent on virt-inspector.
    - Require the ruby package.
    - Disable PHP and Haskell bindings in configure (they wouldn't build anyway,       but this will help people building from source).
    - Set sysconfdir in configure.
    - --enable-debug-command is no longer required by configure script.
    - New command 'virt-make-fs'.
    - Include virt-inspector2, upstream replacement for virt-inspector.
    - Provide hexedit replacement script for guestfish.
    - BR autotools, and rerun after applying patches.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated libguestfs packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

libguestfs is a library for accessing and modifying guest disk images.

libguestfs relied on the format auto-detection in QEMU rather than allowing the guest image file format to be specified. A privileged guest user could potentially use this flaw to read arbitrary files on the host that were accessible to a user on that host who was running a program that utilized the libguestfs library. (CVE-2010-3851)

This erratum upgrades libguestfs to upstream version 1.7.17, which includes a number of bug fixes and one enhancement. Documentation for these bug fixes and this enhancement is provided in the Technical Notes document, linked to in the References section.

All libguestfs users are advised to upgrade to these updated packages, which correct this issue, and fix the bugs and add the enhancement noted in the Technical Notes.

libguestfs is a library for accessing and modifying guest disk images.

libguestfs relied on the format auto-detection in QEMU rather than allowing the guest image file format to be specified. A privileged guest user could potentially use this flaw to read arbitrary files on the host that were accessible to a user on that host who was running a program that utilized the libguestfs library. (CVE-2010-3851)

This erratum upgrades libguestfs to upstream version 1.7.17, which includes a number of bug fixes and one enhancement.

All libguestfs users are advised to upgrade to these updated packages, which correct this issue, and fix the bugs and add the enhancement.

This update moved from the heavily patched version of stable 1.4 that we offered previously in Fedora 13, to the new stable branch 1.6.
Please note the low-risk security problem which is fixed in this release.

CVE-2010-3851 libguestfs: missing disk format specifier when adding a disk https://www.redhat.com/archives/libguestfs/2010-October/msg00036.html

Fix networking in the appliance.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2010-3851: Fix for libguestfs: missing disk format specifier when adding a disk (RHBZ#642934).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
181101	Oracle Linux 6 : libguestfs (ELSA-2011-0586)	Nessus	Oracle Linux Local Security Checks	medium
63981	RHEL 6 : libguestfs (RHSA-2011:0586)	Nessus	Red Hat Local Security Checks	medium
61042	Scientific Linux Security Update : libguestfs on SL6.x x86_64	Nessus	Scientific Linux Local Security Checks	medium
50567	Fedora 13 : libguestfs-1.6.0-1.fc13.1 (2010-17202)	Nessus	Fedora Local Security Checks	medium
50458	Fedora 14 : libguestfs-1.5.23-1 (2010-16835)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-3851

critical

Tenable Plugins

medium

medium

medium

medium

medium