Scientific Linux Security Update : libvirt on SL5.x i386/x86_64
High Nessus Plugin ID 60551
SynopsisThe remote Scientific Linux host is missing one or more security updates.
DescriptionThe libvirtd daemon was discovered to not properly check user connection permissions before performing certain privileged actions, such as requesting migration of an unprivileged guest domain to another system. A local user able to establish a read-only connection to libvirtd could use this flaw to perform actions that should be restricted to read-write connections. (CVE-2008-5086)
libvirt_proxy, a setuid helper application allowing non-privileged users to communicate with the hypervisor, was discovered to not properly validate user requests. Local users could use this flaw to cause a stack-based buffer overflow in libvirt_proxy, possibly allowing them to run arbitrary code with root privileges.
After installing the update, libvirtd must be restarted manually (for example, by issuing a 'service libvirtd restart' command) for this change to take effect.
SolutionUpdate the affected libvirt, libvirt-devel and / or libvirt-python packages.