CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
90.6%
Package : libvirt
Version : 0.9.12.3-1+deb7u2
CVE ID : CVE-2016-5008
It was discovered that there was a password policy issue in libvirt, a
library for interfacing with different virtualization systems.
Setting an empty graphics password is documented as a way to disable
VNC/SPICE access, but QEMU does not always behave like that. VNC would
happily accept the empty password. We enforce the behavior by setting
password expiration to "now".
For Debian 7 "Wheezy", this issue has been fixed in libvirt version
0.9.12.3-1+deb7u2.
We recommend that you upgrade your libvirt packages.
Regards,
,''`.
: :' : Chris Lamb
`. `'` [email protected] / chris-lamb.co.uk
`-
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 8 | kfreebsd-i386 | libvirt-clients | < 1.2.9-9+deb8u3 | libvirt-clients_1.2.9-9+deb8u3_kfreebsd-i386.deb |
Debian | 8 | mips | libvirt-bin | < 1.2.9-9+deb8u3 | libvirt-bin_1.2.9-9+deb8u3_mips.deb |
Debian | 8 | powerpc | libvirt-daemon-system | < 1.2.9-9+deb8u3 | libvirt-daemon-system_1.2.9-9+deb8u3_powerpc.deb |
Debian | 8 | armhf | libvirt-daemon | < 1.2.9-9+deb8u3 | libvirt-daemon_1.2.9-9+deb8u3_armhf.deb |
Debian | 8 | amd64 | libvirt-dev | < 1.2.9-9+deb8u3 | libvirt-dev_1.2.9-9+deb8u3_amd64.deb |
Debian | 8 | armhf | libvirt0-dbg | < 1.2.9-9+deb8u3 | libvirt0-dbg_1.2.9-9+deb8u3_armhf.deb |
Debian | 8 | armhf | libvirt-clients | < 1.2.9-9+deb8u3 | libvirt-clients_1.2.9-9+deb8u3_armhf.deb |
Debian | 8 | s390x | libvirt-dev | < 1.2.9-9+deb8u3 | libvirt-dev_1.2.9-9+deb8u3_s390x.deb |
Debian | 7 | i386 | libvirt0-dbg | < 0.9.12.3-1+deb7u2 | libvirt0-dbg_0.9.12.3-1+deb7u2_i386.deb |
Debian | 8 | i386 | libvirt-clients | < 1.2.9-9+deb8u3 | libvirt-clients_1.2.9-9+deb8u3_i386.deb |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
90.6%