CVE-2011-1146
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Description
libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617773
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056209.html
- http://lists.opensuse.org/opensuse-updates/2011-04/msg00022.html
- http://openwall.com/lists/oss-security/2011/03/09/3
- http://openwall.com/lists/oss-security/2011/03/10/5
References (23)
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.