libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: Setting empty VNC password allows access to unauthorized users (CVE-2016-5008)

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka     RBD), which allows local users to obtain sensitive information via a process listing. (CVE-2015-5160)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for libvirt fixes the following issues: Security issues fixed :

  - CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd'     CPUID feature bits to address V4 Speculative Store     Bypass aka 'Memory Disambiguation' (bsc#1092885).

  - CVE-2018-1064: Fix denial of service problem during     reading from guest agent (bsc#1083625).

  - CVE-2018-5748: Fix resource exhaustion via     qemuMonitorIORead() method (bsc#1076500).

  - CVE-2016-5008: Fix that an empty VNC password disables     authentication (bsc#987527).

  - CVE-2017-5715: Fix speculative side channel attacks aka     'SpectreAttack' (var2) (bsc#1079869). Bug fixes :

  - bsc#980558: Fix NUMA node memory allocation.

  - bsc#968483: Restart daemons in %posttrans after     connection drivers.

  - bsc#897352: Systemd fails to ignore LSB services.

  - bsc#956298: virsh domxml-to-native causes segfault of     libvirtd.

  - bsc#964465: libvirtd.service causes systemd warning     about xencommons service.

  - bsc#954872: Script block-dmmd not working as expected.

  - bsc#854343: libvirt installation run inappropriate     systemd restart.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3576-1 advisory.

    Vivian Zhang and Christoph Anton Mitterer discovered that libvirt incorrectly disabled password     authentication when the VNC password was set to an empty string. A remote attacker could possibly use this     issue to bypass authentication, contrary to expectations. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2016-5008)

    Daniel P. Berrange discovered that libvirt incorrectly handled validating SSL/TLS certificates. A remote     attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu     17.10. (CVE-2017-1000256)

    Daniel P. Berrange and Peter Krempa discovered that libvirt incorrectly handled large QEMU replies. An     attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service.
    (CVE-2018-5748)

    Pedro Sampaio discovered that libvirt incorrectly handled the libnss_dns.so module. An attacker in a     libvirt_lxc session could possibly use this issue to execute arbitrary code. This issue only affected     Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libvirt package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that setting a VNC password to an empty     string in libvirt did not disable all access to the VNC     server as documented, instead it allowed access with no     authentication required. An attacker could use this     flaw to access a VNC server with an empty VNC password     without any authentication.(CVE-2016-5008)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that setting a VNC password to an empty     string in libvirt did not disable all access to the VNC     server as documented, instead it allowed access with no     authentication required. An attacker could use this     flaw to access a VNC server with an empty VNC password     without any authentication.(CVE-2016-5008)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following packages have been upgraded to a newer upstream version:
libvirt (2.0.0).

Security Fix(es) :

  - It was found that the libvirt daemon, when using RBD     (RADOS Block Device), leaked private credentials to the     process list. A local attacker could use this flaw to     perform certain privileged operations within the     cluster. (CVE-2015-5160)

  - A path-traversal flaw was found in the way the libvirt     daemon handled filesystem names for storage volumes. A     libvirt user with privileges to create storage volumes     and without privileges to create and modify domains     could possibly use this flaw to escalate their     privileges. (CVE-2015-5313)

  - It was found that setting a VNC password to an empty     string in libvirt did not disable all access to the VNC     server as documented, instead it allowed access with no     authentication required. An attacker could use this flaw     to access a VNC server with an empty VNC password     without any authentication. (CVE-2016-5008)

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.
In addition, libvirt provides tools for remote management of virtualized systems.

The following packages have been upgraded to a newer upstream version:
libvirt (2.0.0). (BZ#830971, BZ#1286679)

Security Fix(es) :

* It was found that the libvirt daemon, when using RBD (RADOS Block Device), leaked private credentials to the process list. A local attacker could use this flaw to perform certain privileged operations within the cluster. (CVE-2015-5160)

* A path-traversal flaw was found in the way the libvirt daemon handled filesystem names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges. (CVE-2015-5313)

* It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it allowed access with no authentication required. An attacker could use this flaw to access a VNC server with an empty VNC password without any authentication. (CVE-2016-5008)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

This update for libvirt fixes one security issue :

  - CVE-2016-5008: Empty VNC password disables     authentication. (bsc#987527) Additionally, the update     includes the following non-security fixes :

  - Improve waiting for block job readines in virsh.
    (bsc#989755)

  - Parse negative values in augeas lenses. (bsc#975729)

  - Restart daemons in %posttrans after connection drivers     have been processed. (bsc#854343, bsc#968483)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues: Security issues fixed :

  - CVE-2016-5008: empty VNC password disables     authentication (bsc#987527) Bugs fixed :

  - bsc#970906: Fixed a race condition in xenstore event     handling.

  - bsc#952889: Change hap setting to align with Xen     behavior.

  - Fixed 'make check' failures.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

  - Update to libvirt 1.2.18.4 stable release

  - Inherit many upstream bug fixes, including CVE-2016-5008     boo#987527. For details, see     http://wiki.libvirt.org/page/Maintenance_Releases

  - virsh: improve waiting for block job readines     (boo#989755)

- Rebased to version 1.2.18.4

  - CVE-2016-5008: Setting empty VNC password allows access     to unauthorized users (bz #1351516)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 1.3.3.2

  - Fix xen default video device config (bz #1336629)

  - Don't reject duplicate disk serials (bz #1349895)

  - Fix LXC cgroup name mismatch (bz #1350139)

  - Fix managed save/restore with VM USB Keyboard (bz     #1353222)

  - Missing dep on systemd-container (bz #1355784)

  - CVE-2016-5008: Setting empty VNC password allows access     to unauthorized users (bz #1351516)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issue :

  - CVE-2016-5008: empty VNC password disables     authentication (boo#987527)

This update for libvirt fixes the following issues :

  - CVE-2016-5008: empty VNC password disables     authentication (boo#987527)

Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library. When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user to connect, despite the documentation declaring that setting an empty password for the VNC server prevents all client connections. With this update the behaviour is enforced by setting the password expiration to 'now'.

It was discovered that there was a password policy issue in libvirt, a library for interfacing with different virtualization systems.

Setting an empty graphics password is documented as a way to disable VNC/SPICE access, but QEMU does not always behave like that. VNC would happily accept the empty password. We enforce the behavior by setting password expiration to 'now'.

For Debian 7 'Wheezy', this issue has been fixed in libvirt version 0.9.12.3-1+deb7u2.

We recommend that you upgrade your libvirt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199223	RHEL 6 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
111503	SUSE SLES12 Security Update : libvirt (SUSE-SU-2018:2141-1) (Spectre)	Nessus	SuSE Local Security Checks	critical
106928	Ubuntu 14.04 LTS / 16.04 LTS : libvirt vulnerabilities (USN-3576-1)	Nessus	Ubuntu Local Security Checks	critical
99898	EulerOS 2.0 SP1 : libvirt (EulerOS-SA-2017-1053)	Nessus	Huawei Local Security Checks	critical
99897	EulerOS 2.0 SP2 : libvirt (EulerOS-SA-2017-1052)	Nessus	Huawei Local Security Checks	critical
95846	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	critical
95324	CentOS 7 : libvirt (CESA-2016:2577)	Nessus	CentOS Local Security Checks	critical
94700	Oracle Linux 7 : libvirt (ELSA-2016-2577)	Nessus	Oracle Linux Local Security Checks	critical
94540	RHEL 7 : libvirt (RHSA-2016:2577)	Nessus	Red Hat Local Security Checks	critical
93287	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:2053-1)	Nessus	SuSE Local Security Checks	critical
93188	SUSE SLES11 Security Update : libvirt (SUSE-SU-2016:1944-1)	Nessus	SuSE Local Security Checks	critical
92773	openSUSE Security Update : libvirt (openSUSE-2016-943)	Nessus	SuSE Local Security Checks	critical
92591	Fedora 23 : libvirt (2016-7b7e16a39e)	Nessus	Fedora Local Security Checks	critical
92533	Fedora 24 : libvirt (2016-65cc608ebe)	Nessus	Fedora Local Security Checks	critical
92353	openSUSE Security Update : libvirt (openSUSE-2016-875)	Nessus	SuSE Local Security Checks	critical
92352	openSUSE Security Update : libvirt (openSUSE-2016-874)	Nessus	SuSE Local Security Checks	critical
91924	Debian DSA-3613-1 : libvirt - security update	Nessus	Debian Local Security Checks	critical
91921	Debian DLA-541-1 : libvirt security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-5008

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical