libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: Setting empty VNC password allows access to unauthorized users (CVE-2016-5008)

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka     RBD), which allows local users to obtain sensitive information via a process listing. (CVE-2015-5160)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3)     qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly     verify that the disk is attached, which allows remote read-only attackers to cause a denial of service     (libvirtd crash) via the virDomainDetachDeviceFlags command. (CVE-2013-6458)

  - libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and     hang) via a crafted XML document containing an XML external entity declaration in conjunction with an     entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an     XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of     some vectors. CVE-2014-5177 is used for other API methods. (CVE-2014-0179)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The following packages have been upgraded to a newer upstream version:
libvirt (2.0.0).

Security Fix(es) :

  - It was found that the libvirt daemon, when using RBD     (RADOS Block Device), leaked private credentials to the     process list. A local attacker could use this flaw to     perform certain privileged operations within the     cluster. (CVE-2015-5160)

  - A path-traversal flaw was found in the way the libvirt     daemon handled filesystem names for storage volumes. A     libvirt user with privileges to create storage volumes     and without privileges to create and modify domains     could possibly use this flaw to escalate their     privileges. (CVE-2015-5313)

  - It was found that setting a VNC password to an empty     string in libvirt did not disable all access to the VNC     server as documented, instead it allowed access with no     authentication required. An attacker could use this flaw     to access a VNC server with an empty VNC password     without any authentication. (CVE-2016-5008)

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.
In addition, libvirt provides tools for remote management of virtualized systems.

The following packages have been upgraded to a newer upstream version:
libvirt (2.0.0). (BZ#830971, BZ#1286679)

Security Fix(es) :

* It was found that the libvirt daemon, when using RBD (RADOS Block Device), leaked private credentials to the process list. A local attacker could use this flaw to perform certain privileged operations within the cluster. (CVE-2015-5160)

* A path-traversal flaw was found in the way the libvirt daemon handled filesystem names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges. (CVE-2015-5313)

* It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it allowed access with no authentication required. An attacker could use this flaw to access a VNC server with an empty VNC password without any authentication. (CVE-2016-5008)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

ID	Name	Product	Family	Severity
199223	RHEL 6 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199214	RHEL 5 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
95846	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	critical
95324	CentOS 7 : libvirt (CESA-2016:2577)	Nessus	CentOS Local Security Checks	critical
94700	Oracle Linux 7 : libvirt (ELSA-2016-2577)	Nessus	Oracle Linux Local Security Checks	critical
94540	RHEL 7 : libvirt (RHSA-2016:2577)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2015-5160

medium

Tenable Plugins

critical

high

critical

critical

critical

critical