CVE-2015-0236

Updated libvirt packages fix security vulnerability:

The XML getters for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

These are all security issues fixed in the libvirt-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

libvirt was updated to fix one security issue and several non-security issues.

This security issue was fixed:

• CVE-2015-0236: libvirt allowed remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. (bsc#914693)
• CVE-2015-5313: path traversal vulnerability allowed libvirtd process to write arbitrary files into file system using root permissions (bsc#953110)

Theses non-security issues were fixed:

• bsc#948686: Use PAUSED state for domains that are starting up.
• bsc#903757: Provide nodeGetSecurityModel implementation in libxl.
• bsc#938228: Set disk type to BLOCK when driver is not tap or file.
• bsc#948516: Fix profile_status to distinguish between errors and unconfined domains.
• bsc#936524: Fix error starting lxc containers with direct interfaces.
• bsc#921555: Fixed apparmor generated profile for PCI hostdevs.
• bsc#899334: Include additional upstream fixes for systemd TerminateMachine.
• bsc#921586: Fix security driver default settings in /etc/libvirt/qemu.conf.
• bsc#921355: Fixed a number of QEMU apparmor abstraction problems.
• bsc#911737: Additional fix for the case where security labels aren't automatically set.
• bsc#914297: Allow setting the URL of an SMT server to use in place of SCC.
• bsc#904432: Backported route definition changes.

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon was restarted. This could result in an unintended firewall configuration. This issue only applied to Ubuntu 12.04 LTS. (CVE-2011-4600)

Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136)

Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-0236)

Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-5247)

Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313)