CVE-2008-5086 Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions.
HighCVSS 7.2
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libvirt | = 0.3.2 | No fix listed |
| libvirt | = 0.3.3 | No fix listed |
| libvirt | = 0.4.1 | No fix listed |
| libvirt | = 0.4.2 | No fix listed |
| libvirt | = 0.4.6 | No fix listed |
| libvirt | = 0.5.0 | No fix listed |
| libvirt | = 0.5.1 | No fix listed |
| debian/libvirt(Debian:12) | < 0.4.6-10 | 0.4.6-10 |
| debian/libvirt(Debian:13) | < 0.4.6-10 | 0.4.6-10 |
| debian/libvirt(Debian:14) | < 0.4.6-10 | 0.4.6-10 |
References
- SUSE-SR:2009:004 vendor-advisory
- 50919 vdb-entry
- 33198 third-party-advisory
- 33217 third-party-advisory vendor-advisory
- 33292 third-party-advisory
- 34397 third-party-advisory
- FEDORA-2008-11433 vendor-advisory
- RHSA-2009:0382 vendor-advisory
- 32905 patch vdb-entry
- USN-694-1 vendor-advisory
- bugzilla.redhat.com
- oval:org.mitre.oval:def:8765 signature vdb-entry
- [libvirt] 20081217 [SECURITY] PATCH: Fix missing read-only access checks (CVE-2008-5086) mailing-list
- Debian Security Tracker CVE-2008-5086 vendor-advisory