Veracode Vulnerability DatabaseVERACODE:10957Denial Of Service (DoS)
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
libvirt.so is vulnerable to denial of service (DoS). The attack can be triggered during an RPC connection where an attacker can trigger a se-after-free error through the virNetMessageFree function in rpc/virnetserverclient.c, causing the application to crashing or arbitrary code being executed.
References
libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=46532e3e8ed5f5a736a02f67d6c805492f9ca720
libvirt.org/git/?p=libvirt.git;a=commit;h=46532e3e8ed5f5a736a02f67d6c805492f9ca720
libvirt.org/news.html
lists.fedoraproject.org/pipermail/package-announce/2013-February/098326.html
lists.fedoraproject.org/pipermail/package-announce/2013-February/098370.html
lists.fedoraproject.org/pipermail/package-announce/2013-February/098398.html
lists.opensuse.org/opensuse-security-announce/2013-02/msg00001.html
lists.opensuse.org/opensuse-security-announce/2013-02/msg00002.html
lists.opensuse.org/opensuse-security-announce/2013-02/msg00016.html
osvdb.org/89644
rhn.redhat.com/errata/RHSA-2013-0199.html
secunia.com/advisories/52001
secunia.com/advisories/52003
wiki.libvirt.org/page/Maintenance_Releases
www.securityfocus.com/bid/57578
www.securitytracker.com/id/1028047
www.ubuntu.com/usn/USN-1708-1
access.redhat.com/errata/RHSA-2013:0199
access.redhat.com/security/cve/CVE-2013-0170
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=893450
exchange.xforce.ibmcloud.com/vulnerabilities/81552
rhn.redhat.com/errata/RHSA-2013-0199.html
Related
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P