Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 11.04: USN-1152-1 Critical: Libvirt Denial Of Service

ubuntu
Calendar Grey June 16, 2011
Scroller Ubuntu
Ubuntu Security Notice USN-1153-2 addresses vulnerabilities in OpenSSL across various releases, outlining potential threats.
Libvirt could be made to crash or read arbitrary files on the host.

Summary

Libvirt could be made to crash or read arbitrary files on the host.

Software Description:

- libvirt: Libvirt virtualization toolkit

Details:

It was discovered that libvirt did not use thread-safe error reporting. A

remote attacker could exploit this to cause a denial of service via

application crash. (CVE-2011-1486)

Eric Blake discovered that libvirt had an off-by-one error which could

be used to reopen disk probing and bypass the fix for CVE-2010-2238. A

privileged attacker in the guest could exploit this to read arbitrary files

on the host. This issue only affected Ubuntu 11.04. By default, guests are

confined by an AppArmor profile which provided partial protection against

this flaw. (CVE-2011-2178)

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu libvirt

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  libvirt-bin                     0.8.8-1ubuntu6.2
  libvirt0                        0.8.8-1ubuntu6.2

Ubuntu 10.10:
  libvirt-bin                     0.8.3-1ubuntu18
  libvirt0                        0.8.3-1ubuntu18

Ubuntu 10.04 LTS:
  libvirt-bin                     0.7.5-5ubuntu27.13
  libvirt0                        0.7.5-5ubuntu27.13

In general, a standard system update will make all the necessary changes.

References

CVE-2011-1486, CVE-2011-2178

Severity
critical
Lowest
Low
Medium
High
Critical

June 16, 2011

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu libvirt

Package Information

https://launchpad.net/ubuntu/+source/libvirt/0.8.8-1ubuntu6.2
https://launchpad.net/ubuntu/+source/libvirt/0.8.3-1ubuntu18
https://launchpad.net/ubuntu/+source/libvirt/0.7.5-5ubuntu27.13

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.