Scientific Linux Security Update : libvirt on SL5.x i386/x86_64

High Nessus Plugin ID 60551


The remote Scientific Linux host is missing one or more security updates.


The libvirtd daemon was discovered to not properly check user connection permissions before performing certain privileged actions, such as requesting migration of an unprivileged guest domain to another system. A local user able to establish a read-only connection to libvirtd could use this flaw to perform actions that should be restricted to read-write connections. (CVE-2008-5086)

libvirt_proxy, a setuid helper application allowing non-privileged users to communicate with the hypervisor, was discovered to not properly validate user requests. Local users could use this flaw to cause a stack-based buffer overflow in libvirt_proxy, possibly allowing them to run arbitrary code with root privileges.

After installing the update, libvirtd must be restarted manually (for example, by issuing a 'service libvirtd restart' command) for this change to take effect.


Update the affected libvirt, libvirt-devel and / or libvirt-python packages.

See Also

Plugin Details

Severity: High

ID: 60551

File Name: sl_20090319_libvirt_on_SL5_x.nasl

Version: $Revision: 1.1 $

Type: local

Agent: unix

Published: 2012/08/01

Modified: 2012/08/01

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2009/03/19

Reference Information

CVE: CVE-2008-5086, CVE-2009-0036

CWE: 119