1. CVE-Search
  2. CVE-2013-1962
ID CVE-2013-1962
Summary The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
References
Vulnerable Configurations
  • cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:1.0.5:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 13-02-2023 - 04:42)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
bugzilla
id 958839
title Cgroup audit events with path are not escaped
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 6 is installed
      oval oval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • comment libvirt is earlier than 0:0.10.2-18.el6_4.5
          oval oval:com.redhat.rhsa:tst:20130831001
        • comment libvirt is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20131581002
      • AND
        • comment libvirt-client is earlier than 0:0.10.2-18.el6_4.5
          oval oval:com.redhat.rhsa:tst:20130831003
        • comment libvirt-client is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20131581004
      • AND
        • comment libvirt-devel is earlier than 0:0.10.2-18.el6_4.5
          oval oval:com.redhat.rhsa:tst:20130831005
        • comment libvirt-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20131581006
      • AND
        • comment libvirt-lock-sanlock is earlier than 0:0.10.2-18.el6_4.5
          oval oval:com.redhat.rhsa:tst:20130831007
        • comment libvirt-lock-sanlock is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20131581008
      • AND
        • comment libvirt-python is earlier than 0:0.10.2-18.el6_4.5
          oval oval:com.redhat.rhsa:tst:20130831009
        • comment libvirt-python is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20131581010
rhsa
id RHSA-2013:0831
released 2013-05-16
severity Moderate
title RHSA-2013:0831: libvirt security and bug fix update (Moderate)
rpms
  • libvirt-0:0.10.2-18.el6_4.5
  • libvirt-client-0:0.10.2-18.el6_4.5
  • libvirt-debuginfo-0:0.10.2-18.el6_4.5
  • libvirt-devel-0:0.10.2-18.el6_4.5
  • libvirt-lock-sanlock-0:0.10.2-18.el6_4.5
  • libvirt-python-0:0.10.2-18.el6_4.5
refmap via4
bid 59937
confirm
fedora
  • FEDORA-2013-8635
  • FEDORA-2013-8681
mlist
  • [libvir-list] 20130516 [libvirt] [PATCH] daemon: fix leak after listing all volumes
  • [oss-security] 20130516 CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool
osvdb 93451
sectrack 1028577
secunia
  • 53440
  • 53475
suse openSUSE-SU-2013:0885
ubuntu USN-1895-1
xf libvirt-cve20131962-dos(84341)
Last major update 13-02-2023 - 04:42
Published 29-05-2013 - 00:55
Last modified 13-02-2023 - 04:42
Back to Top