libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO     connection, even though an RW connection was supposed to be required, a different vulnerability than     CVE-2019-3886. (CVE-2016-10746)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2019:14146-1 advisory.

  - libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO     connection, even though an RW connection was supposed to be required, a different vulnerability than     CVE-2019-3886. (CVE-2016-10746)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

libvirt-domain.c in libvirt supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required. This could lead to could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.

For Debian 8 'Jessie', this problem has been fixed in version 1.2.9-9+deb8u6.

We recommend that you upgrade your libvirt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254468	Linux Distros Unpatched Vulnerability : CVE-2016-10746	Nessus	Misc.	high
150597	SUSE SLES11 Security Update : libvirt and libvirt-python (SUSE-SU-2019:14146-1)	Nessus	SuSE Local Security Checks	high
124417	Debian DLA-1772-1 : libvirt security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-10746

high

Tenable Plugins

high

high

high