Main Vulnerability Database Vulnerabilities #VU42985

Permissions, Privileges, and Access Controls in libvirt - CVE-2013-1766

Published: March 20, 2013 / Updated: August 11, 2020

Vulnerability identifier: #VU42985

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2013-1766

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: libvirt.org

Affected software:
libvirt

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.

Install update from vendor's website.