libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default. (CVE-2019-3840)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vivian Zhang and Christoph Anton Mitterer discovered that libvirt incorrectly disabled password authentication when the VNC password was set to an empty string. A remote attacker could possibly use this issue to bypass authentication, contrary to expectations. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5008)

Daniel P. Berrange discovered that libvirt incorrectly handled validating SSL/TLS certificates. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 17.10. (CVE-2017-1000256)

Daniel P. Berrange and Peter Krempa discovered that libvirt incorrectly handled large QEMU replies. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2018-5748)

Pedro Sampaio discovered that libvirt incorrectly handled the libnss_dns.so module. An attacker in a libvirt_lxc session could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6764).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2017-1000256: libvirt: TLS certificate verification     disabled for clients (bz #1503687)

  - Fix qemu image locking with shared disks (bz #1513447)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issue fixed :

  - CVE-2017-1000256: Ensure TLS clients always verify the     server certificate in the serial/TLS support.
    (bsc#1062563)

Non security issue fixed :

  - libvirt-daemon-qemu requires     libvirt-daemon-driver-storage (bsc#1062620)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libvirt fixes the following issues: Security issue fixed :

  - CVE-2017-1000256: Ensure TLS clients always verify the     server certificate in the serial/TLS support.
    (bsc#1062563) Non security issue fixed :

  - libvirt-daemon-qemu requires     libvirt-daemon-driver-storage (bsc#1062620)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel P. Berrange reported that Libvirt, a virtualisation abstraction library, does not properly handle the default_tls_x509_verify (and related) parameters in qemu.conf when setting up TLS clients and servers in QEMU, resulting in TLS clients for character devices and disk devices having verification turned off and ignoring any errors while validating the server certificate.

More informations in https://security.libvirt.org/2017/0002.html .

ID	Name	Product	Family	Severity
124959	EulerOS Virtualization 3.0.1.0 : libvirt (EulerOS-SA-2019-1456)	Nessus	Huawei Local Security Checks	high
124897	EulerOS Virtualization for ARM 64 3.0.1.0 : libvirt (EulerOS-SA-2019-1394)	Nessus	Huawei Local Security Checks	high
106928	Ubuntu 14.04 LTS / 16.04 LTS : libvirt vulnerabilities (USN-3576-1)	Nessus	Ubuntu Local Security Checks	critical
105955	Fedora 27 : libvirt (2017-b16cdbdc34)	Nessus	Fedora Local Security Checks	high
104241	openSUSE Security Update : libvirt (openSUSE-2017-1213)	Nessus	SuSE Local Security Checks	high
104172	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2017:2850-1)	Nessus	SuSE Local Security Checks	high
103994	Debian DSA-4003-1 : libvirt - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-1000256

high

Tenable Plugins

high

high

critical

high

high

high

high