The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a (1) DNS or (2) DHCP query.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2867-1 advisory.

    It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon     was restarted. This could result in an unintended firewall configuration. This issue only applied to     Ubuntu 12.04 LTS. (CVE-2011-4600)

    Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local     attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This     issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136)

    Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A     remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected     Ubuntu 14.04 LTS. (CVE-2015-0236)

    Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote     authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This     issue only applied to Ubuntu 15.10. (CVE-2015-5247)

    Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name     validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended     files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fix authorization workflow with PolicyKit. polkit.patch     bnc#735403

  - Fix qemu default migration speed. It should not be     33554432Mb! 61f2b6ba-no-unlimited-mig2file-speed.patch     d8916dc8-def-qemu-migspeed.patch

  - CVE-2011-4600: unintended firewall port exposure after     restarting libvirtd when defining a bridged forward-mode     network ae1232b2-CVE-2011-4600.patch bnc#736082

  - Fix default console type setting     209c2880-multiple-consoles-7.patch

  - Fix 'virsh console' with Xen HVM     xen-hvm-virsh-console.patch bnc#731974

  - Prevent libvirtd crash on 'virsh qemu-attach' when     security_driver is 'none' in /etc/libvirt/qemu.conf     28423019-qemu-attach-crash.patch bnc#735023

  - Allow qemu driver (and hence libvirtd) to load when qemu     user:group does not exist. The kvm or qemu package,     which may not exist on a xen host, creates qemu     user:group. relax-qemu-usergroup-check.patch bnc#711096

  - Accommodate Xen domctl version 8 xen-domctl-ver8.patch

  - Handle empty strings in s-expression returned by xend     a495365d-sexpr-empty-str.patch bnc#731344

  - Allow libvirtd to access libvirt_(io,part)helper when     confined by apparmor Update     install-apparmor-profiles.patch bnc#730435

  - Fixed to return success when there are no errors while     parsing bonding interface miimon xml node parameters.
    bonding-miimon-xml-parsing.patch

This release of libvirt fixes a minor security problem with extraneous iptables rules being added when an externally managed network (new feature in 0.9.4) exists, along with several bugfixes. Another important change in this release is code to automatically convert guest definitions containing the deprecated 'fedora-13' machine type over to 'pc-0.14' - support for the 'fedora-13' machine type will be removed from qemu in Fedora 17, so all guests will need to be reconfigured before that time; the code in this update handles the reconfiguration automatically.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
87888	Ubuntu 14.04 LTS : libvirt vulnerabilities (USN-2867-1)	Nessus	Ubuntu Local Security Checks	medium
74812	openSUSE Security Update : libvirt (openSUSE-2012-78)	Nessus	SuSE Local Security Checks	medium
57437	Fedora 16 : libvirt-0.9.6-4.fc16 (2011-17267)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-4600

medium

Tenable Plugins

medium

medium

medium