CVE-2013-2007

2013-05-2100:00:00

ubuntu.com

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%

JSON

The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when
started in daemon mode, uses weak permissions for certain files, which
allows local users to read and write to these files.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=956082>

Notes

Author	Note
mdeslaur	qemu guest agent is shipped in qemu-kvm binary package in precise. It’s not built in quantal. It’s in the qemu-guest-agent package in raring+
seth-arnold	I didn’t see the qga.c or related files in xen-3.3 or xen packages
mdeslaur	although we shipped the guest agent in the precise qemu-kvm package, we did not ship any init script. Users of this tool are advised to configure it to creates files in directories with appropriate permissions. we will not be releasing an update for precise.