CVE-2014-7823

MEDIUM

Description

The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.

References

http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html

http://secunia.com/advisories/60010

http://secunia.com/advisories/60895

http://secunia.com/advisories/62058

http://secunia.com/advisories/62303

http://security.gentoo.org/glsa/glsa-201412-04.xml

http://security.libvirt.org/2014/0007.html

http://www.ubuntu.com/usn/USN-2404-1

Details

Source: MITRE

Published: 2014-11-13

Updated: 2017-01-03

Type: CWE-255

Risk Information

CVSS v2.0

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Tenable Plugins

View all (16 total)

IDNameProductFamilySeverity
82368Mandriva Linux Security Advisory : libvirt (MDVSA-2015:115)NessusMandriva Local Security Checks
medium
81481SuSE 11.3 Security Update : kvm and libvirt (SAT Patch Number 10222)NessusSuSE Local Security Checks
high
81480SuSE 11.3 Security Update : kvm and libvirt (SAT Patch Number 10222)NessusSuSE Local Security Checks
high
80397Scientific Linux Security Update : libvirt on SL7.x x86_64 (20150105)NessusScientific Linux Local Security Checks
medium
80388RHEL 7 : libvirt (RHSA-2015:0008)NessusRed Hat Local Security Checks
medium
80387Oracle Linux 7 : libvirt (ELSA-2015-0008)NessusOracle Linux Local Security Checks
medium
80360CentOS 7 : libvirt (CESA-2015:0008)NessusCentOS Local Security Checks
medium
79814GLSA-201412-04 : libvirt: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
79412openSUSE Security Update : libvirt (openSUSE-SU-2014:1471-1)NessusSuSE Local Security Checks
medium
79409Mandriva Linux Security Advisory : libvirt (MDVSA-2014:222)NessusMandriva Local Security Checks
medium
79397Fedora 20 : libvirt-1.1.3.8-1.fc20 (2014-15228)NessusFedora Local Security Checks
medium
79372Oracle Linux 6 : libvirt (ELSA-2014-1873)NessusOracle Linux Local Security Checks
medium
79338CentOS 6 : libvirt (CESA-2014:1873)NessusCentOS Local Security Checks
medium
79331Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20141118)NessusScientific Linux Local Security Checks
medium
79329RHEL 6 : libvirt (RHSA-2014:1873)NessusRed Hat Local Security Checks
medium
79210Ubuntu 14.04 LTS / 14.10 : libvirt vulnerabilities (USN-2404-1)NessusUbuntu Local Security Checks
medium