CVE-2013-4236: Low severity red hat enterprise virtualization vulnerability
It was found that fix for CVE-2013-0167 was not complete. A privileged guest user could still potentially make the host the guest is running on unavailable to the management server by making guest agent return data with invalid XML characters.
Upstream fix: http://gerrit.ovirt.org/gitweb?p=vdsm.git;a=commit;h=5fe1615b7949999fc9abd896bde63bf24f8431d6
Acknowledgements:
This issue was found by David Gibson of Red Hat.
Other sources
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via invalid XML characters in a guest agent response. NOTE: this issue is due to an incomplete fix for CVE-2013-0167.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4236?
CVE-2013-4236 is considered a medium severity vulnerability.
How do I fix CVE-2013-4236?
To fix CVE-2013-4236, update to the patched version of Red Hat Enterprise Virtualization for versions 3.0 or 3.2.
Who is affected by CVE-2013-4236?
Red Hat Enterprise Virtualization users running version 3.0 or 3.2 are affected by CVE-2013-4236.
What can an attacker do with CVE-2013-4236?
An attacker with a privileged guest user account can make the management server unavailable by manipulating guest agent data.
Is there a workaround for CVE-2013-4236?
Disabling privileged guest access can serve as a temporary workaround until the issue is patched.