Libvirt Authentication Bypass Vulnerability (CVE-2016-5008)

Libvirt Authentication Bypass Vulnerability (CVE-2016-5008)
Libvirt Authentication Bypass Vulnerability (CVE-2016-5008)

Release date:
Updated on:

Affected Systems:

Libvirt <2.0.0

Description:

CVE (CAN) ID: CVE-2016-5008

The Libvirt library is a Linux API for implementing Linux virtualization. It supports various hypervisors, including Xen and KVM, QEMU, and some virtual products for other operating systems.

In versions earlier than libvirt 2.0.0, after the password on the VNC Server is set to an empty string, the password check is incorrectly disabled. After a remote attacker connects to the server, he can bypass authentication and establish a VNC session.

<* Source: Vivian Zhang
*>

Suggestion:

Vendor patch:

Libvirt
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://security.libvirt.org/2016/0001.html
Https://bugzilla.redhat.com/show_bug.cgi? Id = 1180092
Http://www.debian.org/security/2016/dsa-3613

This article permanently updates the link address: