Ubuntu 15.10 USN-2867-1 Critical: Libvirt Denial Of Service Issues

ubuntu

January 12, 2016

Several security issues were fixed in libvirt.

Summary

Several security issues were fixed in libvirt.

Software Description:

- libvirt: Libvirt virtualization toolkit

Details:

It was discovered that libvirt incorrectly handled the firewall rules on

bridge networks when the daemon was restarted. This could result in an

unintended firewall configuration. This issue only applied to Ubuntu 12.04

LTS. (CVE-2011-4600)

Peter Krempa discovered that libvirt incorrectly handled locking when

certain ACL checks failed. A local attacker could use this issue to cause

libvirt to stop responding, resulting in a denial of service. This issue

only applied to Ubuntu 14.04 LTS. (CVE-2014-8136)

Luyao Huang discovered that libvirt incorrectly handled VNC passwords in

shapshot and image files. A remote authenticated user could use this issue

to possibly obtain VNC passwords. This issue only affected Ubuntu 14.04

LTS. (CVE-2015-0236)

Han Han discovered that libvirt incorrectly handled volume creation

failure when used with NFS. A ...

Read the Full Advisory

Topics Covered

security advisory denial of service critical access control Ubuntu firewall libvirt

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  libvirt-bin                     1.2.16-2ubuntu11.15.10.2
  libvirt0                        1.2.16-2ubuntu11.15.10.2

Ubuntu 15.04:
  libvirt-bin                     1.2.12-0ubuntu14.4
  libvirt0                        1.2.12-0ubuntu14.4

Ubuntu 14.04 LTS:
  libvirt-bin                     1.2.2-0ubuntu13.1.16
  libvirt0                        1.2.2-0ubuntu13.1.16

Ubuntu 12.04 LTS:
  libvirt-bin                     0.9.8-2ubuntu17.23
  libvirt0                        0.9.8-2ubuntu17.23

After a standard system update you need to reboot your computer to make
all the necessary changes.