CVE-2015-0236

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-0236
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://advisories.mageia.org/MGASA-2015-0046.html Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00028.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0323.html Third Party Advisory
http://secunia.com/advisories/62766
http://security.libvirt.org/2015/0001.html Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:035 Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2015:070 Broken Link
http://www.ubuntu.com/usn/USN-2867-1 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.7:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.2.10:*:*:*:*:*:*:*
OR cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
History

12 Feb 2023, 23:15

Type Values Removed Values Added
Summary It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1184431', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1184431', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-0236', 'name': 'https://access.redhat.com/security/cve/CVE-2015-0236', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:0323', 'name': 'https://access.redhat.com/errata/RHSA-2015:0323', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:19

Type Values Removed Values Added
Summary libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1184431 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-0236 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:0323 -
Information

Published : 2015-01-29 15:59

Updated : 2023-12-10 11:31

NVD link : CVE-2015-0236

Mitre link : CVE-2015-0236

CVE.ORG link : CVE-2015-0236

JSON object : View

Products Affected

redhat

  • enterprise_linux_hpc_node
  • enterprise_linux_workstation
  • libvirt
  • enterprise_linux_server
  • enterprise_linux_desktop

mageia

  • mageia

opensuse

  • opensuse

canonical

  • ubuntu_linux
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor