CVE-2014-8170: Critical severity ovirt vulnerability
Dan Kenigsberg of Red Hat reports:
Description of problem: In numerous places, ovirt-node puts an input string on a command line, without safely quoting it. With this, whoever controls the input string may gain complete control on the host.
For example, http://gerrit.ovirt.org/gitweb?p=ovirt-node.git;a=blob;f=src/ovirtnode/ovirtfunctions.py;h=caef7ef019ca12b49aa3c030792538956fb4caad;hb=e11e02cd9256c854dd0419515097637d6829b4f1#l1091
"ls '%s'" % filename
is not going to end up well if the filename is actually "bla\'; rm -fr /; echo \'". pipes.quote() or its like must be used in such occasions.
It may be safer to disallow shell=True completely (but would require to avoid in-shell pipes).
Version-Release number of selected component (if applicable): ovirt-node-3.0.0-474-gb852fd7
Other sources
ovirtsafedeleteconfig in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to execute arbitrary commands via a ; (semicolon) in an input string.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8170?
CVE-2014-8170 has a high severity rating due to its potential to allow an attacker to gain complete control over the affected host.
How do I fix CVE-2014-8170?
To fix CVE-2014-8170, you should upgrade to the latest version of oVirt Node that has implemented proper input handling and security measures.
Which software is affected by CVE-2014-8170?
CVE-2014-8170 affects oVirt Node version 3.0.0-474-gb852fd7.
What is the impact of exploiting CVE-2014-8170?
Exploiting CVE-2014-8170 can allow an attacker to execute arbitrary commands on the host system.
Who reported the vulnerability CVE-2014-8170?
CVE-2014-8170 was reported by Dan Kenigsberg of Red Hat.