SQL injection - CVE-2016-6453

Vulnerability identifier: #VU1085

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6453

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to inject SQL commands on the target system.
The weakness is due to improper input validation. By supplying a specially crafted parameter value, a remote attacker cam execute SQL commands.
Successful exploitation may result in the vulnerable system compromise.

SUSE Linux Enterprise Micro
libvirt-daemon-driver-qemu
libvirt-daemon-driver-interface
libvirt-daemon-driver-interface-debuginfo
libvirt-debugsource
libvirt-daemon-driver-storage
libvirt-libs-debuginfo
libvirt-daemon-driver-nwfilter-debuginfo
libvirt-daemon-driver-storage-core-debuginfo
libvirt-daemon-driver-secret-debuginfo
libvirt-daemon
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-storage-logical-debuginfo
libvirt-client
libvirt-daemon-driver-storage-scsi-debuginfo
libvirt-libs
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-storage-iscsi-debuginfo
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-rbd-debuginfo
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-iscsi-direct-debuginfo
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-nodedev-debuginfo
libvirt-daemon-driver-storage-disk-debuginfo
libvirt-daemon-driver-secret
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-network
libvirt-daemon-driver-storage-mpath-debuginfo
libvirt-daemon-driver-qemu-debuginfo
libvirt-daemon-debuginfo
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-scsi
libvirt-daemon-qemu
libvirt-daemon-driver-network-debuginfo
libvirt-client-debuginfo

Cybersecurity Help is currently unaware of any official patch addressing the vulnerability.

libvirt-daemon-driver-qemu - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-interface - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-interface-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-debugsource - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage - update to 9.0.0-150500.6.23.1
libvirt-libs-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-nwfilter-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-core-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-secret-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-nodedev - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-logical-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-client - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-scsi-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-libs - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-nwfilter - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-iscsi-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-rbd - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-rbd-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-disk - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-iscsi-direct-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-mpath - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-nodedev-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-disk-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-secret - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-iscsi-direct - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-network - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-mpath-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-qemu-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-iscsi - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-core - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-logical - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-storage-scsi - update to 9.0.0-150500.6.23.1
libvirt-daemon-qemu - update to 9.0.0-150500.6.23.1
libvirt-daemon-driver-network-debuginfo - update to 9.0.0-150500.6.23.1
libvirt-client-debuginfo - update to 9.0.0-150500.6.23.1

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-ise

• SQL injection in Cisco Identity Services Engine
• SUSE update for Recommended update for libvirt