libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete     arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container;
    (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the     container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4)     virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under     /proc/$PID/root and the virInitctlSetRunLevel function. (CVE-2013-6456)

  - libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and     connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request     to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event     registration API. (CVE-2014-0028)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service or cause       information leakage. A local attacker may be able to escalate privileges,       cause a Denial of Service or possibly execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update fixes the following security and non security issues with libvirt :

  - bnc#857492: Fix libvirtd crash when hot-plugging disks     for qemu domains (CVE-2013-6458)

  - bnc#858817: Don't crash if a connection closes early     (CVE-2014-1447)

  - bnc#858824: avoid crashing libvirtd when calling `virsh     numatune' on inactive Xen libxl domain (CVE-2013-6457)

  - bnc#859051: filter global events by domain:getattr ACL     (CVE-2014-0028)

  - bnc#817407: Add CAP_SYS_PACCT capability to libvirtd     AppArmor profile

  - bnc#859041: Following the upstream pattern, introduce     the daemon-config-network subpackage to handle defining     the default network

  - bnc#857271: Fix initialization of emulated NICs

  - bnc#857271: Fix potential segfault in libxl driver when     domain create fails

Martin Kletzander discovered that libvirt incorrectly handled reading memory tunables from LXC guests. A local user could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service.
This issue only affected Ubuntu 13.10. (CVE-2013-6436)

Dario Faggioli discovered that libvirt incorrectly handled the libxl driver. A local user could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 13.10. (CVE-2013-6457)

It was discovered that libvirt contained multiple race conditions in block device handling. A remote read-only user could use this flaw to cause libvirtd to crash, resulting in a denial of service.
(CVE-2013-6458)

Eric Blake discovered that libvirt incorrectly handled certain ACLs.
An attacker could use this flaw to possibly obtain certain sensitive information. This issue only affected Ubuntu 13.10. (CVE-2014-0028)

Jiri Denemark discovered that libvirt incorrectly handled keepalives.
A remote attacker could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service. (CVE-2014-1447).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199249	RHEL 7 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
79814	GLSA-201412-04 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75266	openSUSE Security Update : libvirt (openSUSE-SU-2014:0268-1)	Nessus	SuSE Local Security Checks	medium
72232	Ubuntu 12.04 LTS / 12.10 / 13.10 : libvirt vulnerabilities (USN-2093-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2014-0028

high

Tenable Plugins

high

high

medium

medium