CVE-2011-1773: Medium severity matthew booth virt-v2v vulnerability
It was found that after virtual machine conversion using virt-v2v the target VM does not have VNC password enabled even though the source VM does. An attacker able to connect to the target VM can possibly use this flaw to operate the VM with privileges of the logged in user.
Other sources
virt-v2v before 0.8.4 does not preserve the VNC console password when converting a guest, which allows local users to bypass the intended VNC authentication by connecting without a password.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1773?
CVE-2011-1773 is considered a moderate severity vulnerability due to the potential unauthorized access to the target virtual machine.
How do I fix CVE-2011-1773?
To fix CVE-2011-1773, ensure that the target VM has a VNC password set after conversion using virt-v2v.
Which software versions are affected by CVE-2011-1773?
CVE-2011-1773 affects all versions of virt-v2v before 0.8.4.
What kind of attack can exploit CVE-2011-1773?
CVE-2011-1773 can be exploited by an attacker who can connect to the target VM, potentially allowing them to operate with the user's privileges.
Is there a patch available for CVE-2011-1773?
Yes, a patch for CVE-2011-1773 is included in virt-v2v version 0.8.4 and later.