Описание
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | libvirt | Will not fix | ||
| Red Hat Enterprise Linux 6 | libvirt | Under investigation | ||
| Red Hat Storage 2.1 | libvirt | Under investigation | ||
| Red Hat Enterprise Linux 7 | libvirt | Fixed | RHSA-2015:0323 | 05.03.2015 |
| Red Hat Gluster Storage 3.1 for RHEL 7 | libvirt | Fixed | RHSA-2015:0323 | 05.03.2015 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | libvirt | Fixed | RHSA-2015:0323 | 05.03.2015 |
Показывать по
Дополнительная информация
Статус:
EPSS
2.9 Low
CVSS2
Связанные уязвимости
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
libvirt before 1.2.12 allow remote authenticated users to obtain the V ...
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
EPSS
2.9 Low
CVSS2