CVE-2013-2007

2013-05-2100:00:00

ubuntu.com

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

Percentile

5.1%

JSON

The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when
started in daemon mode, uses weak permissions for certain files, which
allows local users to read and write to these files.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=956082>

Notes

Author	Note
mdeslaur	qemu guest agent is shipped in qemu-kvm binary package in precise. It’s not built in quantal. It’s in the qemu-guest-agent package in raring+
seth-arnold	I didn’t see the qga.c or related files in xen-3.3 or xen packages
mdeslaur	although we shipped the guest agent in the precise qemu-kvm package, we did not ship any init script. Users of this tool are advised to configure it to creates files in directories with appropriate permissions. we will not be releasing an update for precise.