libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libvirt version 2.3.0 and later is vulnerable to a bad default configuration of verify-peer=no passed to     QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default. (CVE-2017-1000256)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default. (CVE-2019-3840)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3576-1 advisory.

    Vivian Zhang and Christoph Anton Mitterer discovered that libvirt incorrectly disabled password     authentication when the VNC password was set to an empty string. A remote attacker could possibly use this     issue to bypass authentication, contrary to expectations. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2016-5008)

    Daniel P. Berrange discovered that libvirt incorrectly handled validating SSL/TLS certificates. A remote     attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu     17.10. (CVE-2017-1000256)

    Daniel P. Berrange and Peter Krempa discovered that libvirt incorrectly handled large QEMU replies. An     attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service.
    (CVE-2018-5748)

    Pedro Sampaio discovered that libvirt incorrectly handled the libnss_dns.so module. An attacker in a     libvirt_lxc session could possibly use this issue to execute arbitrary code. This issue only affected     Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- CVE-2017-1000256: libvirt: TLS certificate verification     disabled for clients (bz #1503687)

  - Fix qemu image locking with shared disks (bz #1513447)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issue fixed :

  - CVE-2017-1000256: Ensure TLS clients always verify the     server certificate in the serial/TLS support.
    (bsc#1062563)

Non security issue fixed :

  - libvirt-daemon-qemu requires     libvirt-daemon-driver-storage (bsc#1062620)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libvirt fixes the following issues: Security issue fixed :

  - CVE-2017-1000256: Ensure TLS clients always verify the     server certificate in the serial/TLS support.
    (bsc#1062563) Non security issue fixed :

  - libvirt-daemon-qemu requires     libvirt-daemon-driver-storage (bsc#1062620)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel P. Berrange reported that Libvirt, a virtualisation abstraction library, does not properly handle the default_tls_x509_verify (and related) parameters in qemu.conf when setting up TLS clients and servers in QEMU, resulting in TLS clients for character devices and disk devices having verification turned off and ignoring any errors while validating the server certificate.

More informations in https://security.libvirt.org/2017/0002.html .

ID	Name	Product	Family	Severity
220304	Linux Distros Unpatched Vulnerability : CVE-2017-1000256	Nessus	Misc.	high
124959	EulerOS Virtualization 3.0.1.0 : libvirt (EulerOS-SA-2019-1456)	Nessus	Huawei Local Security Checks	high
124897	EulerOS Virtualization for ARM 64 3.0.1.0 : libvirt (EulerOS-SA-2019-1394)	Nessus	Huawei Local Security Checks	high
106928	Ubuntu 14.04 LTS / 16.04 LTS : libvirt vulnerabilities (USN-3576-1)	Nessus	Ubuntu Local Security Checks	critical
105955	Fedora 27 : libvirt (2017-b16cdbdc34)	Nessus	Fedora Local Security Checks	high
104241	openSUSE Security Update : libvirt (openSUSE-2017-1213)	Nessus	SuSE Local Security Checks	high
104172	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2850-1)	Nessus	SuSE Local Security Checks	high
103994	Debian DSA-4003-1 : libvirt - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-1000256

high

Tenable Plugins

high

high

high

critical

high

high

high

high