—–BEGIN PGP SIGNED MESSAGE—–

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgendes Fedora Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.

Die Bibliothek libvirt stellt eine API zur Verfuegung, welche den
Zugriff auf die Virtualisierungsfunktionen des Linux-Kernels ermoeglicht

CVE-2008-5086 – Schwachstelle in libvirt

Die Bibliothek libvirt enthaelt mehrere Methoden in der API, die
vorhandenen Rechte einer bestehenden Verbindung unzureichend
ueberpruefen. Dies ermoeglicht es Angreifern, ueber Verbindungen, die
eigentlich nur lesend auf die Virtualisierungs-API zugreifen koennen,
Administrationsfunktionen aufzurufen.

Betroffen sind die folgenden Software Pakete und Plattformen:

Paket libvirt

Fedora 9
Fedora 10

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

Hersteller Advisory:
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01015.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00938.html

(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
Michael Groening, DFN-CERT
– —

Michael Groening (Incident Response Team), +49 40 808077-555

DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

Automatische Warnmeldungen https://www.cert.dfn.de/autowarn

– ——————————————————————————–
Fedora Update Notification
FEDORA-2008-11433
2008-12-21 00:41:39
– ——————————————————————————–

Name : libvirt
Product : Fedora 9
Version : 0.5.1
Release : 2.fc9
URL : http://libvirt.org/
Summary : Library providing a simple API virtualization
Description :
Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes).

– ——————————————————————————–
Update Information:

fix missing read-only access checks, fixes CVE-2008-5086 – upstream release
0.5.1 – mostly bugfixes e.g #473071 – some driver improvements
– ——————————————————————————–
ChangeLog:

* Wed Dec 17 2008 Daniel Veillard – 0.5.1-2.fc9
– – fix missing read-only access checks, fixes CVE-2008-5086
* Fri Dec 5 2008 Daniel Veillard – 0.5.1-1.fc9
– – upstream release 0.5.1
– – mostly bugfixes e.g #473071
– – some driver improvments
* Wed Nov 26 2008 Daniel Veillard – 0.5.0-1.fc9
– – upstream release 0.5.0
– – domain lifecycle event support
– – node device enumeration
– – KVM/QEmu migration support
– – improved LXC support
– – SDL display configuration
– – User Mode Linux driver
* Wed Sep 24 2008 Daniel Veillard – 0.4.6-2.fc9
– – a subtle bug in python submakefile broke the 0.4.6-1.fc9 build #463733
* Wed Sep 24 2008 Daniel Veillard – 0.4.6-1.fc9
– – upstream release 0.4.6
– – fixes a couple of serious bugs in the previous release
* Tue Sep 9 2008 Daniel Veillard – 0.4.5-2.fc9
– – fix a crash if a QEmu/KVM domain is defined without an emulator path
* Mon Sep 8 2008 Daniel Veillard – 0.4.5-1.fc9
– – upstream release 0.4.5
– – a lot of bug fixes
– – major updates to QEmu/KVM and Linux containers drivers
– – support for OpenVZ if installed
* Tue Jul 8 2008 Daniel P. Berrange – 0.4.4-2.fc9
– – Fix booting of CDROM images with KVM (rhbz #452355)
* Wed Jun 25 2008 Daniel Veillard – 0.4.4-1.fc9
– – upstream release of 0.4.4
– – fixes a few bug in previous release
* Thu Jun 12 2008 Daniel Veillard – 0.4.3-1.fc9
– – upstream release 0.4.3
– – many bug fixes
– – many small improvements
– – serious xenner fixes
* Wed Jun 4 2008 Mark McLoughlin – 0.4.2-4.fc9
– – Disable lokkit support again (#449996, #447633)
– – Ensure PolicyKit is enabled (#446616)
* Fri May 9 2008 Daniel P. Berrange – 0.4.2-3.fc9
– – Added directory for initrd/kernel images for SELinux policy
* Mon Apr 28 2008 Mark McLoughlin – 0.4.2-2.fc9
– – Enable lokkit support (#443796)
– ——————————————————————————–
References:

[ 1 ] Bug #476560 – CVE-2008-5086 libvirt: missing checks for read-only connection
https://bugzilla.redhat.com/show_bug.cgi?id=476560
– ——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update libvirt’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
– ——————————————————————————–
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.2 (GNU/Linux)

iQEVAwUBSVj2FEhXCWfrVVdXAQH5Pwf9FyqEoMZ79LoiTnpQNMJj4Sm9jOKjZ2oy
Sk7K3nszQTxe9HVLlg6vWjy3GaVb6npQst6KdPbhrAZm0k43YJH8sUx/ek/02zoq
Uqw9aK7yXhN8zORNxXjsj8jWeSNZNbvLS+mPfDgm7Z3OxZG7efY4ZuwL58nHtkb1
G4oNxNCzUbkMLZEnyFYrsf2h0jTwmHM1t/IGTZ2I6Dit5Pyqf8+fw7TxwUd3SAc/
u7b1q1NS+Ogvh2HDX2rN6djbSxc1ImpEcsPsGojeA/hlVxHlzRGD4zt5jb6CShqB
doruOLswzrk0CIPNCQL77F752BLbUowe9jETiczNjDncjARFCkhKMA==
=YVRF
—–END PGP SIGNATURE—–