Bug 484947 (CVE-2009-0036)

Summary:	CVE-2009-0036 libvirt: libvirt_proxy buffer overflow
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	veillard, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0036
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-03-20 07:37:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	479688, 479689
Bug Blocks:

Description Josh Bressers 2009-02-10 20:10:07 UTC

A buffer overflow flaw was found in libvirt_proxy. libvirt_proxy is set to
run as a setuid root by default, so in theory this could allow for a local
user to become root.

Normally the stack protector would prevent this from being an issue, but it
seems that with gcc optimizations, the function in question is being
inlined into main(), preventing the stack protector from catching this.

The original report can be found here:
https://www.redhat.com/archives/libvir-list/2009-January/msg00699.html

The patch is here:
http://git.et.redhat.com/?p=libvirt.git;a=commitdiff;h=2bb0657e28

Comment 2 errata-xmlrpc 2009-03-19 16:10:09 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0382 https://rhn.redhat.com/errata/RHSA-2009-0382.html

Comment 3 Red Hat Product Security 2009-03-20 07:37:02 UTC

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2009-0382.html

Comment 4 errata-xmlrpc 2011-05-05 08:44:54 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0382 https://rhn.redhat.com/errata/RHSA-2009-0382.html