RHEL 6 : libguestfs (RHSA-2012:0774)

medium Nessus Plugin ID 64040

Synopsis

The remote Red Hat host is missing a security update.

Description

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0774 advisory.

libguestfs is a library for accessing and modifying guest disk images.

It was found that editing files with virt-edit left said files in a world-readable state (and did not preserve the file owner or Security-Enhanced Linux context). If an administrator on the host used virt-edit to edit a file inside a guest, the file would be left with world-readable permissions. This could lead to unprivileged guest users accessing files they would otherwise be unable to. (CVE-2012-2690)

These updated libguestfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

Users of libguestfs are advised to upgrade to these updated packages, which fix these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://access.redhat.com/errata/RHSA-2012:0774

https://access.redhat.com/security/updates/classification/#low

https://bugzilla.redhat.com/show_bug.cgi?id=647174

https://bugzilla.redhat.com/show_bug.cgi?id=679737

https://bugzilla.redhat.com/show_bug.cgi?id=719879

https://bugzilla.redhat.com/show_bug.cgi?id=729076

https://bugzilla.redhat.com/show_bug.cgi?id=731742

https://bugzilla.redhat.com/show_bug.cgi?id=741183

https://bugzilla.redhat.com/show_bug.cgi?id=760221

https://bugzilla.redhat.com/show_bug.cgi?id=769359

https://bugzilla.redhat.com/show_bug.cgi?id=785305

https://bugzilla.redhat.com/show_bug.cgi?id=785668

https://bugzilla.redhat.com/show_bug.cgi?id=789960

https://bugzilla.redhat.com/show_bug.cgi?id=790958

https://bugzilla.redhat.com/show_bug.cgi?id=795322

https://bugzilla.redhat.com/show_bug.cgi?id=796520

https://bugzilla.redhat.com/show_bug.cgi?id=797760

https://bugzilla.redhat.com/show_bug.cgi?id=798197

https://bugzilla.redhat.com/show_bug.cgi?id=798980

https://bugzilla.redhat.com/show_bug.cgi?id=799695

https://bugzilla.redhat.com/show_bug.cgi?id=799798

https://bugzilla.redhat.com/show_bug.cgi?id=801273

https://bugzilla.redhat.com/show_bug.cgi?id=801788

https://bugzilla.redhat.com/show_bug.cgi?id=803699

https://bugzilla.redhat.com/show_bug.cgi?id=807557

https://bugzilla.redhat.com/show_bug.cgi?id=807905

https://bugzilla.redhat.com/show_bug.cgi?id=809401

https://bugzilla.redhat.com/show_bug.cgi?id=811112

https://bugzilla.redhat.com/show_bug.cgi?id=811117

https://bugzilla.redhat.com/show_bug.cgi?id=811673

https://bugzilla.redhat.com/show_bug.cgi?id=812092

https://bugzilla.redhat.com/show_bug.cgi?id=813329

https://bugzilla.redhat.com/show_bug.cgi?id=831117

http://www.nessus.org/u?25c51fb6

http://www.nessus.org/u?ea29af6b

Plugin Details

Severity: Medium

ID: 64040

File Name: redhat-RHSA-2012-0774.nasl

Version: 1.19

Type: local

Agent: unix

Published: 1/24/2013

Updated: 4/15/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2012-2690

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:libguestfs-tools-c, p-cpe:/a:redhat:enterprise_linux:libguestfs-java, p-cpe:/a:redhat:enterprise_linux:ruby-libguestfs, p-cpe:/a:redhat:enterprise_linux:ocaml-libguestfs-devel, p-cpe:/a:redhat:enterprise_linux:libguestfs, p-cpe:/a:redhat:enterprise_linux:python-libguestfs, p-cpe:/a:redhat:enterprise_linux:libguestfs-tools, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:libguestfs-devel, p-cpe:/a:redhat:enterprise_linux:perl-sys-guestfs, p-cpe:/a:redhat:enterprise_linux:ocaml-libguestfs, p-cpe:/a:redhat:enterprise_linux:libguestfs-javadoc, p-cpe:/a:redhat:enterprise_linux:libguestfs-java-devel

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 6/20/2012

Vulnerability Publication Date: 6/29/2012

Reference Information

CVE: CVE-2012-2690

BID: 53932

RHSA: 2012:0774