The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen     option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket     file in this directory, which allows local users to write to the socket and execute arbitrary commands by     creating /tmp/.guestfish-$UID/ in advance. (CVE-2013-4419)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated libguestfs packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Libguestfs is a library and set of tools for accessing and modifying guest disk images.

It was found that guestfish, which enables shell scripting and command line access to libguestfs, insecurely created the temporary directory used to store the network socket when started in server mode. A local attacker could use this flaw to intercept and modify other user's guestfish command, allowing them to perform arbitrary guestfish actions with the privileges of a different user, or use this flaw to obtain authentication credentials. (CVE-2013-4419)

This issue was discovered by Michael Scherer of the Red Hat Regional IT team.

These updated libguestfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All libguestfs users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

It was found that guestfish, which enables shell scripting and command line access to libguestfs, insecurely created the temporary directory used to store the network socket when started in server mode. A local attacker could use this flaw to intercept and modify other user's guestfish command, allowing them to perform arbitrary guestfish actions with the privileges of a different user, or use this flaw to obtain authentication credentials. (CVE-2013-4419)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1536 advisory.

    - Fix CVE-2013-4419: insecure temporary directory handling for       guestfish's network socket       resolves: rhbz#1019737
    - Fix DoS (abort) due to a double free flaw when inspecting certain guest       files / images (CVE-2013-2124)       resolves: rhbz#968337

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1536 advisory.

    Libguestfs is a library and set of tools for accessing and modifying guest     disk images.

    It was found that guestfish, which enables shell scripting and command line     access to libguestfs, insecurely created the temporary directory used to     store the network socket when started in server mode. A local attacker     could use this flaw to intercept and modify other user's guestfish command,     allowing them to perform arbitrary guestfish actions with the privileges of     a different user, or use this flaw to obtain authentication credentials.
    (CVE-2013-4419)

    This issue was discovered by Michael Scherer of the Red Hat Regional IT     team.

    These updated libguestfs packages include numerous bug fixes and     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical     Notes, linked to in the References, for information on the most significant     of these changes.

    All libguestfs users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues and add these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New upstream branch 1.24. Fixes CVE-2013-4419. New upstream version 1.23.33. New upstream version 1.23.32. New upstream version 1.23.31.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A predictable socketname in the guestfish commandline tool could be used by a local attacker to gain access to guestfish sessions of other users on the same system. (CVE-2013-4419)

New upstream stable branch version 1.22.7, fixing CVE-2013-4419.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream stable branch version 1.20.12, fixing CVE-2013-4419.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254136	Linux Distros Unpatched Vulnerability : CVE-2013-4419	Nessus	Misc.	high
79156	CentOS 6 : libguestfs (CESA-2013:1536)	Nessus	CentOS Local Security Checks	medium
71194	Scientific Linux Security Update : libguestfs on SL6.x x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	medium
71125	Oracle Linux 6 : libguestfs (ELSA-2013-1536)	Nessus	Oracle Linux Local Security Checks	high
70999	RHEL 6 : libguestfs (RHSA-2013:1536)	Nessus	Red Hat Local Security Checks	critical
70821	Fedora 20 : libguestfs-1.24.0-1.fc20 (2013-19553)	Nessus	Fedora Local Security Checks	medium
70758	SuSE 11.3 Security Update : guestfs (SAT Patch Number 8465)	Nessus	SuSE Local Security Checks	medium
70644	Fedora 19 : libguestfs-1.22.7-1.fc19 (2013-19492)	Nessus	Fedora Local Security Checks	medium
70642	Fedora 18 : libguestfs-1.20.12-1.fc18 (2013-19452)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4419

high

Tenable Plugins

high

medium

medium

high

critical

medium

medium

medium

medium