CVE-2013-1766: Low severity red hat libvirt-daemon-driver-storage-iscsi-direct vulnerability
Published Mar 20, 2013
·Updated
libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.
Affected Software
72 affected components
redhat libvirt<=1.0.2
redhat libvirt=0.0.1
redhat libvirt=0.0.2
redhat libvirt=0.0.3
redhat libvirt=0.0.4
redhat libvirt=0.0.5
redhat libvirt=0.0.6
redhat libvirt=0.1.0
redhat libvirt=0.1.1
redhat libvirt=0.1.3
redhat libvirt=0.1.4
redhat libvirt=0.1.5
redhat libvirt=0.1.6
redhat libvirt=0.1.7
redhat libvirt=0.1.8
redhat libvirt=0.1.9
redhat libvirt=0.2.0
redhat libvirt=0.2.1
redhat libvirt=0.2.2
redhat libvirt=0.2.3
redhat libvirt=0.3.0
redhat libvirt=0.3.1
redhat libvirt=0.3.2
redhat libvirt=0.3.3
redhat libvirt=0.4.0
redhat libvirt=0.4.1
redhat libvirt=0.4.2
redhat libvirt=0.4.3
redhat libvirt=0.4.4
redhat libvirt=0.4.5
redhat libvirt=0.4.6
redhat libvirt=0.5.0
redhat libvirt=0.5.1
redhat libvirt=0.6.0
redhat libvirt=0.6.1
redhat libvirt=0.6.2
redhat libvirt=0.6.3
redhat libvirt=0.6.4
redhat libvirt=0.6.5
redhat libvirt=0.7.0
redhat libvirt=0.7.1
redhat libvirt=0.7.2
redhat libvirt=0.7.3
redhat libvirt=0.7.4
redhat libvirt=0.7.5
redhat libvirt=0.7.6
redhat libvirt=0.7.7
redhat libvirt=0.8.0
redhat libvirt=0.8.1
redhat libvirt=0.8.2
redhat libvirt=0.8.3
redhat libvirt=0.8.4
redhat libvirt=0.8.5
redhat libvirt=0.8.6
redhat libvirt=0.8.7
redhat libvirt=0.8.8
redhat libvirt=0.9.0
redhat libvirt=0.9.1
redhat libvirt=0.9.2
redhat libvirt=0.9.3
redhat libvirt=0.9.4
redhat libvirt=0.9.5
redhat libvirt=0.9.6
redhat libvirt=0.9.7
redhat libvirt=0.9.8
redhat libvirt=0.9.9
redhat libvirt=0.9.10
redhat libvirt=0.9.11
redhat libvirt=0.9.12
redhat libvirt=0.9.13
redhat libvirt=1.0.0
redhat libvirt=1.0.1
Event History
Mar 20, 2013
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-1766?
CVE-2013-1766 has a moderate severity rating due to its potential to allow local users to modify device files.
2
How do I fix CVE-2013-1766?
To fix CVE-2013-1766, update libvirt to version 1.0.3 or later, which corrects the improper permissions on device files.
3
What versions of Red Hat Libvirt are affected by CVE-2013-1766?
Red Hat Libvirt versions up to and including 1.0.2 are affected by CVE-2013-1766.
4
Could CVE-2013-1766 be exploited remotely?
No, CVE-2013-1766 can only be exploited by local users with access to the affected system.
5
What is the nature of the vulnerability in CVE-2013-1766?
CVE-2013-1766 stems from incorrect group permissions for device files, which can be manipulated by local users.