libvirt 'virt-login-shell' Local Privilege Escalation Vulnerability

Bugtraq ID:	63324
Class:	Input Validation Error
CVE:	CVE-2013-4400
Remote:	No
Local:	Yes
Published:	Oct 21 2013 12:00AM
Updated:	Apr 13 2015 10:25PM
Credit:	Sebastian Krahmer of the SUSE Security Team
Vulnerable:	libvirt libvirt 1.1.2 Gentoo Linux
Not Vulnerable:

libvirt 'virt-login-shell' Local Privilege Escalation Vulnerability

libvirt is prone to a local privilege escalation vulnerability.

Local attackers can exploit this issue to overwrite arbitrary files and gain elevated privileges.

libvirt 1.1.2 is vulnerable; other versions may also be affected.

libvirt 'virt-login-shell' Local Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libvirt 'virt-login-shell' Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

libvirt 'virt-login-shell' Local Privilege Escalation Vulnerability

References:

• Bug 1015228 - (CVE-2013-4400) CVE-2013-4400 libvirt: virt-login-shell arbitrary (Red Hat Bugzilla)
  
• Close all non-stdio FDs in virt-login-shell (CVE-2013-4400) (Daniel P. Berrange)
  
• Don't link virt-login-shell against libvirt.so (CVE-2013-4400) (Daniel P. Berrange)
  
• Fix perms for virConnectDomainXML{To,From}Native (CVE-2013-4401) (Daniel P. Berrange)
  
• libvirt Homepage (libvirt )
  
• Only allow 'stderr' log output when running setuid (CVE-2013-4400) (Daniel P. Berrange)