libvirt Event Registration API Remote Security Bypass Vulnerability

Bugtraq ID:	65004
Class:	Access Validation Error
CVE:	CVE-2014-0028
Remote:	Yes
Local:	No
Published:	Jan 15 2014 12:00AM
Updated:	Dec 10 2014 12:55AM
Credit:	The vendor reported this issue.
Vulnerable:	Gentoo Linux
Not Vulnerable:

libvirt Event Registration API Remote Security Bypass Vulnerability

libvirt is prone to a remote security-bypass vulnerability because it fails to properly check the ACL permissions.

An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks.

libvirt 1.2.0 is vulnerable; other versions may also be affected.

libvirt Event Registration API Remote Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libvirt Event Registration API Remote Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

libvirt Event Registration API Remote Security Bypass Vulnerability

References:

• libvirt Homepage (libvirt )