The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Updated libguestfs packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Libguestfs is a library and set of tools for accessing and modifying guest disk images.

It was found that guestfish, which enables shell scripting and command line access to libguestfs, insecurely created the temporary directory used to store the network socket when started in server mode. A local attacker could use this flaw to intercept and modify other user's guestfish command, allowing them to perform arbitrary guestfish actions with the privileges of a different user, or use this flaw to obtain authentication credentials. (CVE-2013-4419)

This issue was discovered by Michael Scherer of the Red Hat Regional IT team.

These updated libguestfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All libguestfs users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

It was found that guestfish, which enables shell scripting and command line access to libguestfs, insecurely created the temporary directory used to store the network socket when started in server mode. A local attacker could use this flaw to intercept and modify other user's guestfish command, allowing them to perform arbitrary guestfish actions with the privileges of a different user, or use this flaw to obtain authentication credentials. (CVE-2013-4419)

From Red Hat Security Advisory 2013:1536 :

Updated libguestfs packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Libguestfs is a library and set of tools for accessing and modifying guest disk images.

It was found that guestfish, which enables shell scripting and command line access to libguestfs, insecurely created the temporary directory used to store the network socket when started in server mode. A local attacker could use this flaw to intercept and modify other user's guestfish command, allowing them to perform arbitrary guestfish actions with the privileges of a different user, or use this flaw to obtain authentication credentials. (CVE-2013-4419)

This issue was discovered by Michael Scherer of the Red Hat Regional IT team.

These updated libguestfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All libguestfs users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

New upstream branch 1.24. Fixes CVE-2013-4419. New upstream version 1.23.33. New upstream version 1.23.32. New upstream version 1.23.31.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A predictable socketname in the guestfish commandline tool could be used by a local attacker to gain access to guestfish sessions of other users on the same system. (CVE-2013-4419)

New upstream stable branch version 1.22.7, fixing CVE-2013-4419.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream stable branch version 1.20.12, fixing CVE-2013-4419.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79156	CentOS 6 : libguestfs (CESA-2013:1536)	Nessus	CentOS Local Security Checks	medium
71194	Scientific Linux Security Update : libguestfs on SL6.x x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
71125	Oracle Linux 6 : libguestfs (ELSA-2013-1536)	Nessus	Oracle Linux Local Security Checks	medium
70999	RHEL 6 : libguestfs (RHSA-2013:1536)	Nessus	Red Hat Local Security Checks	medium
70821	Fedora 20 : libguestfs-1.24.0-1.fc20 (2013-19553)	Nessus	Fedora Local Security Checks	medium
70758	SuSE 11.3 Security Update : guestfs (SAT Patch Number 8465)	Nessus	SuSE Local Security Checks	medium
70644	Fedora 19 : libguestfs-1.22.7-1.fc19 (2013-19492)	Nessus	Fedora Local Security Checks	medium
70642	Fedora 18 : libguestfs-1.20.12-1.fc18 (2013-19452)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4419

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium