libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete     arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container;
    (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the     container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4)     virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under     /proc/$PID/root and the virInitctlSetRunLevel function. (CVE-2013-6456)

  - libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and     connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request     to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event     registration API. (CVE-2014-0028)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: Setting empty VNC password allows access to unauthorized users (CVE-2016-5008)

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka     RBD), which allows local users to obtain sensitive information via a process listing. (CVE-2015-5160)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3)     qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly     verify that the disk is attached, which allows remote read-only attackers to cause a denial of service     (libvirtd crash) via the virDomainDetachDeviceFlags command. (CVE-2013-6458)

  - libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and     hang) via a crafted XML document containing an XML external entity declaration in conjunction with an     entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an     XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of     some vectors. CVE-2014-5177 is used for other API methods. (CVE-2014-0179)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default. (CVE-2019-3840)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3576-1 advisory.

    Vivian Zhang and Christoph Anton Mitterer discovered that libvirt incorrectly disabled password     authentication when the VNC password was set to an empty string. A remote attacker could possibly use this     issue to bypass authentication, contrary to expectations. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2016-5008)

    Daniel P. Berrange discovered that libvirt incorrectly handled validating SSL/TLS certificates. A remote     attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu     17.10. (CVE-2017-1000256)

    Daniel P. Berrange and Peter Krempa discovered that libvirt incorrectly handled large QEMU replies. An     attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service.
    (CVE-2018-5748)

    Pedro Sampaio discovered that libvirt incorrectly handled the libnss_dns.so module. An attacker in a     libvirt_lxc session could possibly use this issue to execute arbitrary code. This issue only affected     Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- CVE-2017-1000256: libvirt: TLS certificate verification     disabled for clients (bz #1503687)

  - Fix qemu image locking with shared disks (bz #1513447)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issue fixed :

  - CVE-2017-1000256: Ensure TLS clients always verify the     server certificate in the serial/TLS support.
    (bsc#1062563)

Non security issue fixed :

  - libvirt-daemon-qemu requires     libvirt-daemon-driver-storage (bsc#1062620)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libvirt fixes the following issues: Security issue fixed :

  - CVE-2017-1000256: Ensure TLS clients always verify the     server certificate in the serial/TLS support.
    (bsc#1062563) Non security issue fixed :

  - libvirt-daemon-qemu requires     libvirt-daemon-driver-storage (bsc#1062620)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel P. Berrange reported that Libvirt, a virtualisation abstraction library, does not properly handle the default_tls_x509_verify (and related) parameters in qemu.conf when setting up TLS clients and servers in QEMU, resulting in TLS clients for character devices and disk devices having verification turned off and ignoring any errors while validating the server certificate.

More informations in https://security.libvirt.org/2017/0002.html .

ID	Name	Product	Family	Severity
199249	RHEL 7 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199223	RHEL 6 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199214	RHEL 5 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
124959	EulerOS Virtualization 3.0.1.0 : libvirt (EulerOS-SA-2019-1456)	Nessus	Huawei Local Security Checks	high
124897	EulerOS Virtualization for ARM 64 3.0.1.0 : libvirt (EulerOS-SA-2019-1394)	Nessus	Huawei Local Security Checks	high
106928	Ubuntu 14.04 LTS / 16.04 LTS : libvirt vulnerabilities (USN-3576-1)	Nessus	Ubuntu Local Security Checks	critical
105955	Fedora 27 : libvirt (2017-b16cdbdc34)	Nessus	Fedora Local Security Checks	high
104241	openSUSE Security Update : libvirt (openSUSE-2017-1213)	Nessus	SuSE Local Security Checks	high
104172	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2850-1)	Nessus	SuSE Local Security Checks	high
103994	Debian DSA-4003-1 : libvirt - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-1000256

high

Tenable Plugins

high

critical

high

high

high

critical

high

high

high

high