libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Aug 30, 2017 | Jul 13, 2016 |
| Debian | — | Upgrade libvirt | Jul 4, 2016 | Jul 2, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade libvirt-client | Nov 30, 2017 | Jul 13, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-qemuUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-networkUpgrade libvirt-clientUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon | Nov 30, 2017 | Jul 13, 2016 |
| Oracle_linux | — | Upgrade libvirt-login-shellUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-clientUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-nssUpgrade libvirt-develUpgrade libvirt-daemon-kvmUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storageUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-nodedevUpgrade libvirtUpgrade libvirt-daemon-lxc | Nov 9, 2016 | Jan 18, 2015 |
| Redhat_linux | — | Upgrade libvirtUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-develUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-networkUpgrade libvirt-login-shellUpgrade libvirt-debuginfoUpgrade libvirt-daemon-config-networkUpgrade libvirt-clientUpgrade libvirt-nssUpgrade libvirt-daemonUpgrade libvirt-docsNo solution existsUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-kvm | Nov 4, 2016 | Jul 13, 2016 |
| Suse | — | Upgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-lock-sanlockUpgrade perl-Sys-VirtUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-qemuUpgrade libvirt-develUpgrade libvirt-daemon-lxcUpgrade libvirt-devel-32bitUpgrade libvirt-docUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-xenUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-nodedevUpgrade libvirtUpgrade libvirt-client-32bitUpgrade libvirt-client | Jul 26, 2016 | Jul 13, 2016 |
| Ubuntu | — | Upgrade libvirt-binUpgrade libvirt0 | Feb 21, 2018 | Jul 13, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub