CVE-2016-5008

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

Updated libvirt packages fix security vulnerability:

Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library. When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user to connect, despite the documentation declaring that setting an empty password for the VNC server prevents all client connections. With this update the behaviour is enforced by setting the password expiration to "now" (CVE-2016-5008).

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2016-5008: empty VNC password disables authentication (bsc#987527)

Bugs fixed:

• bsc#970906: Fixed a race condition in xenstore event handling.
• bsc#952889: Change hap setting to align with Xen behavior.
• Fixed 'make check' failures.

This update for libvirt fixes one security issue:

• CVE-2016-5008: Empty VNC password disables authentication. (bsc#987527)

Additionally, the update includes the following non-security fixes:

• Improve waiting for block job readines in virsh. (bsc#989755)
• Parse negative values in augeas lenses. (bsc#975729)
• Restart daemons in %posttrans after connection drivers have been processed. (bsc#854343, bsc#968483)

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' (bsc#1092885).
• CVE-2018-1064: Fix denial of service problem during reading from guest agent (bsc#1083625).
• CVE-2018-5748: Fix resource exhaustion via qemuMonitorIORead() method (bsc#1076500).
• CVE-2016-5008: Fix that an empty VNC password disables authentication (bsc#987527).
• CVE-2017-5715: Fix speculative side channel attacks aka 'SpectreAttack' (var2) (bsc#1079869).

Bug fixes:

• bsc#980558: Fix NUMA node memory allocation.
• bsc#968483: Restart daemons in %posttrans after connection drivers.
• bsc#897352: Systemd fails to ignore LSB services.
• bsc#956298: virsh domxml-to-native causes segfault of libvirtd.
• bsc#964465: libvirtd.service causes systemd warning about xencommons service.
• bsc#954872: Script block-dmmd not working as expected.
• bsc#854343: libvirt installation run inappropriate systemd restart.

Vivian Zhang and Christoph Anton Mitterer discovered that libvirt incorrectly disabled password authentication when the VNC password was set to an empty string. A remote attacker could possibly use this issue to bypass authentication, contrary to expectations. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5008)

Daniel P. Berrange discovered that libvirt incorrectly handled validating SSL/TLS certificates. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 17.10. (CVE-2017-1000256)

Daniel P. Berrange and Peter Krempa discovered that libvirt incorrectly handled large QEMU replies. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2018-5748)

Pedro Sampaio discovered that libvirt incorrectly handled the libnss_dns.so module. An attacker in a libvirt_lxc session could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-6764)