CVE-2013-4419
libguestfs: insecure temporary directory handling for guestfish's network socket
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
El comando guestfish en libguestfs 1.20.12, 1.22.7 y anteriores versiones, cuando se usa la opción --remote o --listen, no comprueba adecuadamente la propiedad de /tmp/.guestfish-$UID/ al crear un archivo de socket temporal en este directorio, lo que permite a usuarios locales escribir en el socket y ejecutar comandos arbitrarios mediante la creación de /tmp/.guestfish-$UID/ por adelantado.
Libguestfs is a library and set of tools for accessing and modifying guest disk images. It was found that guestfish, which enables shell scripting and command line access to libguestfs, insecurely created the temporary directory used to store the network socket when started in server mode. A local attacker could use this flaw to intercept and modify other user's guestfish command, allowing them to perform arbitrary guestfish actions with the privileges of a different user, or use this flaw to obtain authentication credentials.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-06-12 CVE Reserved
- 2013-11-05 CVE Published
- 2024-08-06 CVE Updated
- 2025-04-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-377: Insecure Temporary File
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/55813 | Third Party Advisory | |
| https://www.redhat.com/archives/libguestfs/2013-October/msg00031.html | Mailing List |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1016960 | 2013-11-20 |
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.html | 2018-12-13 | |
| http://rhn.redhat.com/errata/RHSA-2013-1536.html | 2018-12-13 | |
| https://access.redhat.com/security/cve/CVE-2013-4419 | 2013-11-20 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libguestfs Search vendor "Libguestfs" | Libguestfs Search vendor "Libguestfs" for product "Libguestfs" | >= 1.20.0 <= 1.20.12 Search vendor "Libguestfs" for product "Libguestfs" and version " >= 1.20.0 <= 1.20.12" | - |
Affected
| ||||||
| Libguestfs Search vendor "Libguestfs" | Libguestfs Search vendor "Libguestfs" for product "Libguestfs" | >= 1.22.0 <= 1.22.7 Search vendor "Libguestfs" for product "Libguestfs" and version " >= 1.22.0 <= 1.22.7" | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Suse Linux Enterprise Software Development Kit Search vendor "Suse" for product "Suse Linux Enterprise Software Development Kit" | 11.0 Search vendor "Suse" for product "Suse Linux Enterprise Software Development Kit" and version "11.0" | sp3 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "11.0" | sp3 |
Affected
| ||||||