CVE-2013-4401
Ubuntu Security Notice USN-2026-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
La función de la API virConnectDomainXMLToNative en libvirt versiones 1.1.0 hasta 1.1.3, comprueba el permiso connect:read en lugar del permiso connect:write, que permite a los atacantes conseguir privilegios domain:write y ejecutar archivos binarios de Qemu por medio de un XML diseñado. NOTA: algunos de estos detalles se obtienen a partir de información de terceros.
It was discovered that libvirt incorrectly checked privileges when the virConnectDomainXMLToNative API function was used. An attacker could possibly use this flaw to gain write privileges, contrary to expected behaviour.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-06-12 CVE Reserved
- 2013-11-02 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=57687fd6bf7f6e1b3662c52f3f26c06ab19dc96c | X_refsource_confirm | |
| http://secunia.com/advisories/60895 | Third Party Advisory | |
| http://wiki.libvirt.org/page/Maintenance_Releases | X_refsource_confirm | |
| http://www.securitytracker.com/id/1029241 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1015259 | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/55210 | 2023-11-07 | |
| http://security.gentoo.org/glsa/glsa-201412-04.xml | 2023-11-07 | |
| http://www.ubuntu.com/usn/USN-2026-1 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Libvirt Search vendor "Redhat" for product "Libvirt" | 1.1.0 Search vendor "Redhat" for product "Libvirt" and version "1.1.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Libvirt Search vendor "Redhat" for product "Libvirt" | 1.1.1 Search vendor "Redhat" for product "Libvirt" and version "1.1.1" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Libvirt Search vendor "Redhat" for product "Libvirt" | 1.1.2 Search vendor "Redhat" for product "Libvirt" and version "1.1.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Libvirt Search vendor "Redhat" for product "Libvirt" | 1.1.3 Search vendor "Redhat" for product "Libvirt" and version "1.1.3" | - |
Affected
| ||||||