ID CVE-2011-4600
Summary The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a (1) DNS or (2) DHCP query.
References
Vulnerable Configurations
  • Canonical Ubuntu Linux 15.10
    cpe:2.3:o:canonical:ubuntu_linux:15.10
  • Canonical Ubuntu Linux 15.04
    cpe:2.3:o:canonical:ubuntu_linux:15.04
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Canonical Ubuntu Linux 12.04 LTS
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:-:-:lts
  • Red Hat libvirt 0.9.8
    cpe:2.3:a:redhat:libvirt:0.9.8
CVSS
Base: 4.3 (as of 18-04-2016 - 12:08)
Impact:
Exploitability:
CWE CWE-284
CAPEC
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2011-17267.NASL
    description This release of libvirt fixes a minor security problem with extraneous iptables rules being added when an externally managed network (new feature in 0.9.4) exists, along with several bugfixes. Another important change in this release is code to automatically convert guest definitions containing the deprecated 'fedora-13' machine type over to 'pc-0.14' - support for the 'fedora-13' machine type will be removed from qemu in Fedora 17, so all guests will need to be reconfigured before that time; the code in this update handles the reconfiguration automatically. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-10-18
    plugin id 57437
    published 2012-01-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57437
    title Fedora 16 : libvirt-0.9.6-4.fc16 (2011-17267)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2012-78.NASL
    description - Fix authorization workflow with PolicyKit. polkit.patch bnc#735403 - Fix qemu default migration speed. It should not be 33554432Mb! 61f2b6ba-no-unlimited-mig2file-speed.patch d8916dc8-def-qemu-migspeed.patch - CVE-2011-4600: unintended firewall port exposure after restarting libvirtd when defining a bridged forward-mode network ae1232b2-CVE-2011-4600.patch bnc#736082 - Fix default console type setting 209c2880-multiple-consoles-7.patch - Fix 'virsh console' with Xen HVM xen-hvm-virsh-console.patch bnc#731974 - Prevent libvirtd crash on 'virsh qemu-attach' when security_driver is 'none' in /etc/libvirt/qemu.conf 28423019-qemu-attach-crash.patch bnc#735023 - Allow qemu driver (and hence libvirtd) to load when qemu user:group does not exist. The kvm or qemu package, which may not exist on a xen host, creates qemu user:group. relax-qemu-usergroup-check.patch bnc#711096 - Accommodate Xen domctl version 8 xen-domctl-ver8.patch - Handle empty strings in s-expression returned by xend a495365d-sexpr-empty-str.patch bnc#731344 - Allow libvirtd to access libvirt_{io,part}helper when confined by apparmor Update install-apparmor-profiles.patch bnc#730435 - Fixed to return success when there are no errors while parsing bonding interface miimon xml node parameters. bonding-miimon-xml-parsing.patch
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 74812
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74812
    title openSUSE Security Update : libvirt (openSUSE-2012-78)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2867-1.NASL
    description It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon was restarted. This could result in an unintended firewall configuration. This issue only applied to Ubuntu 12.04 LTS. (CVE-2011-4600) Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136) Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-0236) Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-5247) Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 87888
    published 2016-01-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87888
    title Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : libvirt vulnerabilities (USN-2867-1)
refmap via4
confirm
ubuntu USN-2867-1
Last major update 18-04-2016 - 14:06
Published 14-04-2016 - 11:59
Back to Top