virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-585:02 advisory.

    Libguestfs is a library for accessing and modifying guest disk images. Amongst the things this is good     for: making batch configuration changes to guests, getting disk used/free statistics (see also: virt-df),     migrating between virtualization systems (see also: virt-p2v), performing partial backups, performing     partial guest clones, cloning guests and changing registry/UUID/hostname info, and much else besides.
    Libguestfs uses Linux kernel and qemu code, and can access any type of guest filesystem that Linux and     qemu can, including but not limited to: ext2/3/4, btrfs, FAT and NTFS, LVM, many different disk partition     schemes, qcow, qcow2, vmdk.
    Libguestfs provides ways to enumerate guest storage (eg. partitions, LVs, what filesystem is in each LV,     etc.). It can also run commands in the context of the guest.
    Libguestfs is a library that can be linked with C and C++ management programs.
     See also the 'guestfish' package for shell scripting and command line access, and 'libguestfs-mount' for     mounting guest filesystems on the host using FUSE.
     For Perl bindings, see 'perl-Sys-Guestfs'.
     For OCaml bindings, see 'ocaml-libguestfs-devel'.
     For Python bindings, see 'python-libguestfs'.
     For Ruby bindings, see 'ruby-libguestfs'.
     For Java bindings, see 'libguestfs-java-devel'.
    Security issues fixed with this release:
     CVE-2012-2690     virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves     the new file with world-readable permissions when editing, which might allow local guest users to obtain     sensitive information.
    Bug Fixes      Previously, the virt-clone would adopt some of the properties of the original virtual machine (for     example, the clone was created with a NIC identical to the original VM's). This has been solved by 2 new     tools: virt-sysprep and virt-sparsify. Virt-sysprep can erase the guest state; virt-sparsify can make the     image sparse. Both these tools should be used instead of or in conjunction with virt-clone.
     When trying to mount a non-existent disk, the libguestfs daemon crashed. This has been fixed, a error     message is returned and libguestfs does not crash.
     The library containing the guestfs_launch() function has been modified to be thread-safe: two threads     from the same program can now access the library.
     After a block device was closed, the udev device manager re-opened the block device through a triggered     process. libguestfs operations would then fail, as they expect the disk being available for the kernel to     re-read the partition table. This has been fixed: operations now wait for udev to finish.
     Fedora 17 and newer use a symbolic link for the /bin directory. libguestfs has been modified to handle     such guests.
     Any disk containing autoexec.bat, boot.ini or the ntdlr file in its root would appear as a Windows root     disk for libguestfs. HP recovery partitions were not recognized and libguestfs handled the system as dual-     boot, so some virt tools did not work. This has been fixed and HP recovery partitions are not seen as a     Windows root disk.
     Fixed libguestfs error string handling and Python programs no longer terminate with a segmentation fault     when calling the g.launch()function.
    Enhancements      Added the virt-alignment-scan tool and updated virt-resize. Guest partitions can now be diagnosed and     their problems fixed, which imporves the partition performance.
     libguestfs operations can now handle HP Smart Array (cciss) devices. The virt-p2v tool can now convert     systems that use Linux software RAID devices to run in a VM.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0774 advisory.

    [1:1.16.19-1]
    - Rebase to libguestfs 1.16.19       resolves: rhbz#719879
    - Rebuild against augeas 0.9.0-3.el6       related: rhbz#808662
    - Fix: Don't abort inspection if mdadm.conf ARRAY doesn't have a uuid.
    - Switch back to git for patch management.

    [1:1.16.18-2]
    - Rebase to libguestfs 1.16.18       resolves: rhbz#719879
    - Fix: guestfs_last_error not set when qemu fails early during launch       resolves: rhbz#811673
    - Fix: RFE: virt-sysprep: hostname can not be changed on rhel system       (RHBZ#811112)
    - Fix: RFE: virt-sysprep: net-hwaddr not removed from ifcfg-* files on       rhel (RHBZ#811117)
    - Fix: inspection fails on ubuntu 10.04 guest with encrypted swap (RHBZ#811872)
    - Fix: cannot open disk images which are symlinks to files that       contain ':' (colon) character (RHBZ#812092)
    - BR gettext-devel so we can rerun autoconf.

    [1:1.16.15-1]
    - Rebase to libguestfs 1.16.15       resolves: rhbz#719879
    - Fix: inspection doesn't recognize Fedora 17+ (RHBZ#809401)

    [1:1.16.14-1]
    - Rebase to libguestfs 1.16.14       resolves: rhbz#719879
    - virt-sysprep should use virt-inspector2       resolves: rhbz#807557
    - Fix: mkfs blocksize option breaks when creating btrfs       resolves: rhbz#807905

    [1:1.16.12-1]
    - Rebase to libguestfs 1.16.12       resolves: rhbz#719879
    - Fix: could not locate HKLM\SYSTEM\MountedDevices       resolves: rhbz#803699

    [1:1.16.10-1]
    - Rebase to libguestfs 1.16.10       resolves: rhbz#719879
    - Fix: libguestfs holds open file descriptors when handle is launched       resolves: rhbz#801788
    - Fix: Document for set-pgroup need to be updated       resolves: rhbz#801273
    - Fix: Possible null dereference and resource leaks       resolves: rhbz#801298

    [1:1.16.8-1]
    - Rebase to libguestfs 1.16.8       resolves: rhbz#719879
    - Fix set_autosync function so it is not 'ConfigOnly'       resolves: rhbz#796520
    - Fix header compilation for C++       resolves: rhbz#799695

    [1:1.16.6-1]
    - Rebase to libguesfs 1.16.6       resolves: rhbz#798197, rhbz#797760,rhbz#790958,rhbz#798980,rhbz#795322,rhbz#796520
    - Fix virt-inspector2 man page.

    [1:1.16.5-1]
    - Rebase to libguestfs 1.16.5       resolves: rhbz#679737, rhbz#789960

    [1:1.16.4-1]
    - Rebase to libguestfs 1.16.4       resolves: rhbz#788642

    [1:1.16.3-1]
    - Rebase to libguestfs 1.16.3       resolves: rhbz#679737, rhbz#769359, rhbz#785305

    [1:1.16.2-1]
    - Rebase to libguestfs 1.16.2       resolves: rhbz#719879

    [1:1.16.1-1]
    - Rebase to libguestfs 1.16.1
    - Disable tests (probably because we are hitting       https://lists.gnu.org/archive/html/qemu-devel/2010-02/threads.html#00823 )       resolves: rhbz#719879

    [1:1.14.7-4]
    - Continue with rebase to libguestfs 1.14.7       resolves: rhbz#719879

    [1:1.14.7-1]
    - Rebase to libguestfs 1.14.7       resolves: rhbz#719879

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0774 advisory.

    libguestfs is a library for accessing and modifying guest disk images.

    It was found that editing files with virt-edit left said files in a     world-readable state (and did not preserve the file owner or     Security-Enhanced Linux context). If an administrator on the host used     virt-edit to edit a file inside a guest, the file would be left with     world-readable permissions. This could lead to unprivileged guest users     accessing files they would otherwise be unable to. (CVE-2012-2690)

    These updated libguestfs packages include numerous bug fixes and     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical     Notes for information on the most significant of these changes.

    Users of libguestfs are advised to upgrade to these updated packages, which     fix these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

libguestfs is a library for accessing and modifying guest disk images.

It was found that editing files with virt-edit left said files in a world-readable state (and did not preserve the file owner or Security-Enhanced Linux context). If an administrator on the host used virt-edit to edit a file inside a guest, the file would be left with world-readable permissions. This could lead to unprivileged guest users accessing files they would otherwise be unable to.
(CVE-2012-2690)

These updated libguestfs packages include numerous bug fixes and enhancements.

Users of libguestfs are advised to upgrade to these updated packages, which fix these issues and add these enhancements.

Updated libguestfs packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

libguestfs is a library for accessing and modifying guest disk images.

It was found that editing files with virt-edit left said files in a world-readable state (and did not preserve the file owner or Security-Enhanced Linux context). If an administrator on the host used virt-edit to edit a file inside a guest, the file would be left with world-readable permissions. This could lead to unprivileged guest users accessing files they would otherwise be unable to.
(CVE-2012-2690)

These updated libguestfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

Users of libguestfs are advised to upgrade to these updated packages, which fix these issues and add these enhancements.

ID	Name	Product	Family	Severity
284001	MiracleLinux 4 : libguestfs-1.16.19-1.0.1.AXS4 (AXSA:2012-585:02)	Nessus	Miracle Linux Local Security Checks	medium
68548	Oracle Linux 6 : libguestfs (ELSA-2012-0774)	Nessus	Oracle Linux Local Security Checks	medium
64040	RHEL 6 : libguestfs (RHSA-2012:0774)	Nessus	Red Hat Local Security Checks	medium
61339	Scientific Linux Security Update : libguestfs on SL6.x x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	low
59919	CentOS 6 : libguestfs (CESA-2012:0774)	Nessus	CentOS Local Security Checks	low

Detections

Analytics

CVE-2012-2690

medium

Tenable Plugins

medium

medium

medium

low

low