CVE-2015-5313: Path Traversal

Published Apr 11, 2016

Updated

Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storagebackendfs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storagevol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.

Affected Software

1 affected component

redhat libvirt

Remediation

Patch Available

http://security.libvirt.org/2015/0004.html

Event History

Apr 11, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-5313?

CVE-2015-5313 is classified as a medium severity vulnerability.

How do I fix CVE-2015-5313?

To fix CVE-2015-5313, update to the latest version of Red Hat Libvirt that contains the security patch.

What type of vulnerability is CVE-2015-5313?

CVE-2015-5313 is a directory traversal vulnerability that allows unauthorized file access.

Who is affected by CVE-2015-5313?

CVE-2015-5313 affects local users with specific ACL permissions in Red Hat Libvirt.

What are the consequences of exploiting CVE-2015-5313?

Exploiting CVE-2015-5313 can allow attackers to write to arbitrary files on the system.