CVE-2011-0011

qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.

Published Bysecalert@redhat.com

Published DateJun 21, 2012, 15:55

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

4.3

Vector String

AV:A/AC:H/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://rhn.redhat.com/errata/RHSA-2011-0345.html
http://secunia.com/advisories/42830
http://secunia.com/advisories/43272
http://secunia.com/advisories/43733
http://secunia.com/advisories/44393
http://ubuntu.com/usn/usn-1063-1
http://www.openwall.com/lists/oss-security/2011/01/10/3
http://www.openwall.com/lists/oss-security/2011/01/11/1
http://www.openwall.com/lists/oss-security/2011/01/12/2
http://www.osvdb.org/70992
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/697197
https://exchange.xforce.ibmcloud.com/vulnerabilities/65215

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

4.3

Vector String

AV:A/AC:H/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL