CVSS: 2.1EPSS: 0%CPEs: 33EXPL: 0CVE-2010-2242 – libvirt: improperly mapped source privileged ports may allow for obtaining privileged resources on the host
https://notcve.org/view.php?id=CVE-2010-2242
Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree. Red Hat libvirt v0.2.0 hasta v0.8.2 crea reglas de iptable con asignaciones inadecuadas de puertos de origen privilegiados, lo que permite a usuarios invitados del SO evitar las restricciones de acceso establecidas aprovechando los valores de dirección IP y puerto-origen, como se ha demostrado copiando y eliminando un arbol de ficheros NFS. • http://libvirt.org/news.html http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://ubuntu.com/usn/usn-1008-1 http://ubuntu.com/usn/usn-1008-2 http://ubuntu.com/usn/usn-1008-3 http://www.redhat.com/support/errata/RHSA-2010-0615.html http://www.vupen.com/english/advisories/2010/2062 http • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.4EPSS: 0%CPEs: 9EXPL: 0CVE-2010-2238
https://notcve.org/view.php?id=CVE-2010-2238
Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors. Red Hat libvirt, posiblemente v0.7.2 hasta v0.8.2, se repite en almacenes de respaldo de imagen de disco sin extraer el formato de disco de respaldo definido, lo cual puede permitir a usuarios invitados del Sistema Operativo leer ficheros a su elección en el Sistema Operativo anfitrión, y posiblemente tener otros impactos no especificados, a través de vectores desconocidos. • http://libvirt.org/news.html http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://ubuntu.com/usn/usn-1008-1 http://ubuntu.com/usn/usn-1008-2 http://ubuntu.com/usn/usn-1008-3 http://www.vupen.com/english/advisories/2010/2763 https://bugzilla.redhat.com/show_bug.cgi?id=607811 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.4EPSS: 0%CPEs: 17EXPL: 0CVE-2010-2239 – libvirt: not setting user defined backing store format when creating new image
https://notcve.org/view.php?id=CVE-2010-2239
Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors. Red Hat libvirt, posiblemente v0.6.0 hasta v0.8.2, crea nuevas imagenes sin configurar el formato definido por el usuario backing-store, lo que permite a usuarios invitados al SO leer ficheros de su elección en el SO anfitrión a través de vectores sin especificar. • http://libvirt.org/news.html http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://ubuntu.com/usn/usn-1008-1 http://ubuntu.com/usn/usn-1008-2 http://ubuntu.com/usn/usn-1008-3 http://www.redhat.com/support/errata/RHSA-2010-0615.html http://www.vupen.com/english/advisories/2010/2062 http • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 4CVE-2009-0036 – libvirt_proxy 0.5.1 - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2009-0036
Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check. Desbordamiento de búfer en la función proxyReadClientSocket en proxy/libvirt_proxy.c en libvirt_proxy v0.5.1, podría permitir a usuarios locales elevar sus privilegios mediante el envío de una parte de la cabecera de un paquete virProxyPacket y posteriormente enviando el resto del paquete con valores manipulados en la cabecera del mismo. Relacionado con el uso de memoria que no ha sido inicializada en un control de validación. • https://www.exploit-db.com/exploits/8534 http://git.et.redhat.com/?p=libvirt.git%3Ba=commitdiff%3Bh=2bb0657e28 http://openwall.com/lists/oss-security/2009/02/10/8 http://secunia.com/advisories/34397 http://www.redhat.com/support/errata/RHSA-2009-0382.html http://www.securityfocus.com/bid/33724 https://bugzilla.redhat.com/show_bug.cgi?id=484947 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10127 https://www.redhat.com/archives/libv • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2008-5086 – libvirt: missing checks for read-only connection
https://notcve.org/view.php?id=CVE-2008-5086
Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions. Múltiples métodos en libvirt 0.3.2 a 0.5.1 no comprueban si una conexión es de sólo lectura, lo que permite a usuarios locales eludir restricciones de acceso y realizar acciones administrativas. • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://osvdb.org/50919 http://secunia.com/advisories/33198 http://secunia.com/advisories/33217 http://secunia.com/advisories/33292 http://secunia.com/advisories/34397 http://www.redhat.com/archives/fedora-package-announce/2008-December/msg00938.html http://www.redhat.com/support/errata/RHSA-2009-0382.html http://www.securityfocus.com/bid/32905 http://www.ubuntu.com/usn/usn-694-1 https://bugzilla.r •