libvirt Local Security Bypass Vulnerability

Bugtraq ID:	32905
Class:	Access Validation Error
CVE:	CVE-2008-5086
Remote:	No
Local:	Yes
Published:	Dec 18 2008 12:00AM
Updated:	Mar 19 2009 07:56PM
Credit:	Ubuntu
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 SuSE SUSE Linux Enterprise Server 10 SP2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 RedHat Enterprise Linux Virtualization 5 server RedHat Enterprise Linux Desktop Multi OS 5 client Red Hat Fedora 9 libvirt libvirt 0.5.1
Not Vulnerable:

libvirt Local Security Bypass Vulnerability

The 'libvirt' library is prone to a local security-bypass vulnerability.

Successful exploits may give attackers access to privileged operations.

This issue affects libvirt 0.3.2 through 0.5.1.

libvirt Local Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libvirt Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 7.10 i386

• Ubuntu libvirt-bin_0.3.0-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/libv/libvirt/libvirt-b in_0.3.0-0ubuntu2.1_i386.deb


• Ubuntu libvirt-dev_0.3.0-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-dev_0 .3.0-0ubuntu2.1_i386.deb


• Ubuntu libvirt0_0.3.0-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0_0.3. 0-0ubuntu2.1_i386.deb


• Ubuntu python-libvirt_0.3.0-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/libv/libvirt/python-li bvirt_0.3.0-0ubuntu2.1_i386.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu libvirt-bin_0.4.4-3ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt-bin_0.4.4-3ubun tu3.1_lpia.deb


• Ubuntu libvirt-dev_0.4.4-3ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt-dev_0.4.4-3ubun tu3.1_lpia.deb


• Ubuntu libvirt-doc_0.4.4-3ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.4-3ubuntu3.1_all.deb


• Ubuntu libvirt0-dbg_0.4.4-3ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt0-dbg_0.4.4-3ubu ntu3.1_lpia.deb


• Ubuntu libvirt0_0.4.4-3ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt0_0.4.4-3ubuntu3 .1_lpia.deb


• Ubuntu python-libvirt_0.4.4-3ubuntu3.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/python-libvirt_0.4.4-3u buntu3.1_lpia.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu libvirt-bin_0.4.4-3ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt-bin_0.4.4-3ubun tu3.1_sparc.deb


• Ubuntu libvirt-dev_0.4.4-3ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt-dev_0.4.4-3ubun tu3.1_sparc.deb


• Ubuntu libvirt-doc_0.4.4-3ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.4-3ubuntu3.1_all.deb


• Ubuntu libvirt0-dbg_0.4.4-3ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt0-dbg_0.4.4-3ubu ntu3.1_sparc.deb


• Ubuntu libvirt0_0.4.4-3ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt0_0.4.4-3ubuntu3 .1_sparc.deb


• Ubuntu python-libvirt_0.4.4-3ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/python-libvirt_0.4.4-3u buntu3.1_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libvirt-doc_0.4.0-2ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.0-2ubuntu8.1_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu libvirt-bin_0.4.4-3ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt-bin_0.4.4-3ubun tu3.1_powerpc.deb


• Ubuntu libvirt-dev_0.4.4-3ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt-dev_0.4.4-3ubun tu3.1_powerpc.deb


• Ubuntu libvirt-doc_0.4.4-3ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.4-3ubuntu3.1_all.deb


• Ubuntu libvirt0-dbg_0.4.4-3ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt0-dbg_0.4.4-3ubu ntu3.1_powerpc.deb


• Ubuntu libvirt0_0.4.4-3ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt0_0.4.4-3ubuntu3 .1_powerpc.deb


• Ubuntu python-libvirt_0.4.4-3ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/python-libvirt_0.4.4-3u buntu3.1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu libvirt-bin_0.4.4-3ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-bin_0 .4.4-3ubuntu3.1_i386.deb


• Ubuntu libvirt-dev_0.4.4-3ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-dev_0 .4.4-3ubuntu3.1_i386.deb


• Ubuntu libvirt-doc_0.4.4-3ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.4-3ubuntu3.1_all.deb


• Ubuntu libvirt0-dbg_0.4.4-3ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0-dbg_ 0.4.4-3ubuntu3.1_i386.deb


• Ubuntu libvirt0_0.4.4-3ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0_0.4. 4-3ubuntu3.1_i386.deb


• Ubuntu python-libvirt_0.4.4-3ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/python-libvir t_0.4.4-3ubuntu3.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libvirt-doc_0.4.0-2ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.0-2ubuntu8.1_all.deb

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu libvirt-bin_0.3.0-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/libv/libvirt/libvirt-b in_0.3.0-0ubuntu2.1_amd64.deb


• Ubuntu libvirt-dev_0.3.0-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-dev_0 .3.0-0ubuntu2.1_amd64.deb


• Ubuntu libvirt0_0.3.0-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0_0.3. 0-0ubuntu2.1_amd64.deb


• Ubuntu python-libvirt_0.3.0-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/libv/libvirt/python-li bvirt_0.3.0-0ubuntu2.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libvirt-bin_0.4.0-2ubuntu8.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-bin_0 .4.0-2ubuntu8.1_i386.deb


• Ubuntu libvirt-dev_0.4.0-2ubuntu8.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-dev_0 .4.0-2ubuntu8.1_i386.deb


• Ubuntu libvirt-doc_0.4.0-2ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.0-2ubuntu8.1_all.deb


• Ubuntu libvirt0-dbg_0.4.0-2ubuntu8.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0-dbg_ 0.4.0-2ubuntu8.1_i386.deb


• Ubuntu libvirt0_0.4.0-2ubuntu8.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0_0.4. 0-2ubuntu8.1_i386.deb


• Ubuntu python-libvirt_0.4.0-2ubuntu8.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/python-libvir t_0.4.0-2ubuntu8.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libvirt-bin_0.4.0-2ubuntu8.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-bin_0 .4.0-2ubuntu8.1_amd64.deb


• Ubuntu libvirt-dev_0.4.0-2ubuntu8.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-dev_0 .4.0-2ubuntu8.1_amd64.deb


• Ubuntu libvirt-doc_0.4.0-2ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.0-2ubuntu8.1_all.deb


• Ubuntu libvirt0-dbg_0.4.0-2ubuntu8.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0-dbg_ 0.4.0-2ubuntu8.1_amd64.deb


• Ubuntu libvirt0_0.4.0-2ubuntu8.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0_0.4. 0-2ubuntu8.1_amd64.deb


• Ubuntu python-libvirt_0.4.0-2ubuntu8.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/python-libvir t_0.4.0-2ubuntu8.1_amd64.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu libvirt-bin_0.4.4-3ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-bin_0 .4.4-3ubuntu3.1_amd64.deb


• Ubuntu libvirt-dev_0.4.4-3ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-dev_0 .4.4-3ubuntu3.1_amd64.deb


• Ubuntu libvirt-doc_0.4.4-3ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.4-3ubuntu3.1_all.deb


• Ubuntu libvirt0-dbg_0.4.4-3ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0-dbg_ 0.4.4-3ubuntu3.1_amd64.deb


• Ubuntu libvirt0_0.4.4-3ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt0_0.4. 4-3ubuntu3.1_amd64.deb


• Ubuntu python-libvirt_0.4.4-3ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/python-libvir t_0.4.4-3ubuntu3.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libvirt-doc_0.4.0-2ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/libv/libvirt/libvirt-doc_0 .4.0-2ubuntu8.1_all.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu libvirt-bin_0.3.0-0ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/libv/libvirt/libvirt-bin_0.3.0-0 ubuntu2.1_lpia.deb


• Ubuntu libvirt-dev_0.3.0-0ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt-dev_0.3.0-0ubun tu2.1_lpia.deb


• Ubuntu libvirt0_0.3.0-0ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libv/libvirt/libvirt0_0.3.0-0ubuntu2 .1_lpia.deb


• Ubuntu python-libvirt_0.3.0-0ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/libv/libvirt/python-libvirt_0.3. 0-0ubuntu2.1_lpia.deb

libvirt Local Security Bypass Vulnerability

References:

• [libvirt] [SECURITY] PATCH: Fix missing read-only access checks (CVE-2008-5086) (libvirt )
  
• Add missing checks for read-only connection flag (CVE-2008-5086) (libvirt)
  
• libvirt Homepage (libvirt )