Detections
Analytics
MiracleLinux 4 : libguestfs-1.20.11-2.0.1.AXS4 (AXSA:2014-288:02)
high Nessus Plugin ID 289866
Synopsis
The remote MiracleLinux host is missing a security update.Description
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-288:02 advisory.Libguestfs is a library for accessing and modifying guest disk images. Amongst the things this is good for: making batch configuration changes to guests, getting disk used/free statistics (see also: virt-df), migrating between virtualization systems (see also: virt-p2v), performing partial backups, performing partial guest clones, cloning guests and changing registry/UUID/hostname info, and much else besides.
Libguestfs uses Linux kernel and qemu code, and can access any type of guest filesystem that Linux and qemu can, including but not limited to: ext2/3/4, btrfs, FAT and NTFS, LVM, many different disk partition schemes, qcow, qcow2, vmdk.
Libguestfs provides ways to enumerate guest storage (eg. partitions, LVs, what filesystem is in each LV, etc.). It can also run commands in the context of the guest.
Libguestfs is a library that can be linked with C and C++ management programs.
For high level virt tools, guestfish (shell scripting and command line access), and guestmount (mount guest filesystems using FUSE), install 'libguestfs-tools'.
For shell scripting and command line access, install 'guestfish'.
To mount guest filesystems on the host using FUSE, install 'libguestfs-mount'.
For Java bindings, install 'libguestfs-java-devel'.
For OCaml bindings, install 'ocaml-libguestfs-devel'.
For Perl bindings, install 'perl-Sys-Guestfs'.
For Python bindings, install 'python-libguestfs'.
For Ruby bindings, install 'ruby-libguestfs'.
Security issues fixed with this release:
CVE-2013-4419 The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
Fixed bugs:
Removed buildnet: builds now detect network automatically.
Backported new APIs part-get-gpt-type and part-set-gpt-type Fixed DoS (abort) due to a double free flaw when inspecting certain guest files / images.
Previously, libguestfs failed to detect MS Windows guests that used a non-default systemroot path. This has been fixed: it now uses the boot.ini file to find the systemroot path.
Added the back state commands to guestfish.
Previously, ntfsresize would fail if the target size was not specified. This has been fixed and libguestfs now automatically establishes the size of the target storage device.
Fixed the txz-out API.
Moved the virt-sysprep to the libguestfs-tools-c package since it's no longer a shell script.
Fixed hostname inspection: it was faulty because of Augeas path expression Previously, libguestfs entered an infinite loop when using the iface parameter when adding a rive. This has been fixed.
Added notes about resizing Windows disk images to virt-resize documentation Removed the dependency on lsscsi.
Fixed yum cache copy so it works when there are several repositories.
Fixed hivex-commit API to fail with relative paths.
Improved the documentation for filesystem-available API.
Fixed double free when kernel link fails during launch Fixed virt-sysprep --firstboot option.
Fixed cap-get-file so it returns empty string instead of error on no cap.
Improved the documentation for acl-set-file.
Fixed bogus waitpid error message when using guestfish --remote.
Disabled 9p support.
Documented that guestfish --remote doesn't work with certain other arguments.
Previously, when under heavy load, messages would appear in the debug output. libguestfs now checks if the kvmclock kernel feature is enabled, which reduces the output.
Previously, if a file system was not mounted before running the guestfs_sh or sh command, the guestfish utility would crash with a segmentation fault. A check has been added in guestfish and it reports an error message if the file system is not mounted.
Added various fixes to tar-out 'excludes'.
Documented the use of glob + rsync-out.
Documented mke2fs blockscount.
Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 289866
File Name: miracle_linux_AXSA-2014-288.nasl
Version: 1.1
Type: local
Published: 1/16/2026
Updated: 1/16/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2013-4419
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:miracle:linux:libguestfs-java, p-cpe:/a:miracle:linux:libguestfs-tools, p-cpe:/a:miracle:linux:libguestfs-tools-c, p-cpe:/a:miracle:linux:perl-sys-guestfs, cpe:/o:miracle:linux:4, p-cpe:/a:miracle:linux:python-libguestfs, p-cpe:/a:miracle:linux:libguestfs
Required KB Items: Host/local_checks_enabled, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 5/5/2014
Vulnerability Publication Date: 10/9/2013
Reference Information
CVE: CVE-2013-4419