CVE-2013-4292 - libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a l

CVE-2013-4292

Summary

libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a large number of domain migrate parameters in certain RPC calls in (1) daemon/remote.c and (2) remote/remote_driver.c.

References

http://libvirt.org/news.html
http://secunia.com/advisories/60895
http://security.gentoo.org/glsa/glsa-201412-04.xml
http://www.mail-archive.com/libvir-list%40redhat.com/msg83332.html

Vulnerable Configurations

cpe:2.3:a:redhat:libvirt:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:libvirt:1.1.0:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 13-02-2023 - 04:45)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:N/I:N/A:P

refmap via4

confirm	http://libvirt.org/news.html
gentoo	GLSA-201412-04
mlist	[libvirt] 20130829 [PATCH 01/12] Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292)
secunia	60895

Last major update

13-02-2023 - 04:45

Published

30-09-2013 - 21:55

Last modified

13-02-2023 - 04:45