RHSA-2012:0774 - Security Advisory

Topic

Updated libguestfs packages that fix one security issue, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

libguestfs is a library for accessing and modifying guest disk images.

It was found that editing files with virt-edit left said files in a
world-readable state (and did not preserve the file owner or
Security-Enhanced Linux context). If an administrator on the host used
virt-edit to edit a file inside a guest, the file would be left with
world-readable permissions. This could lead to unprivileged guest users
accessing files they would otherwise be unable to. (CVE-2012-2690)

These updated libguestfs packages include numerous bug fixes and
enhancements. Space precludes documenting all of these changes in this
advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical
Notes for information on the most significant of these changes.

Users of libguestfs are advised to upgrade to these updated packages, which
fix these issues and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64

Fixes

• BZ - 647174 - RHEL6: virt-clone should remove old udev rules when changing MAC address
• BZ - 679737 - libguestfs: improve error message when zerofree is not available in the appliance
• BZ - 719879 - Rebase libguestfs in RHEL 6.3
• BZ - 729076 - libguestfs confuses Hp_recovery partition with Windows root filesystem
• BZ - 731742 - libguestfs should escape special/non-printing characters in debug output
• BZ - 741183 - [RFE] Write a tool to align the partition(s) in a Windows XP image to a multiple of 8 sectors
• BZ - 760221 - RFE: Support inspection of cciss devices
• BZ - 769359 - virt-resize on RHEL 6 kernel fails to re-read the partition table
• BZ - 785305 - ocaml (bytecode) bindings segfault in 'add_drive_opts'
• BZ - 785668 - aug-defnode: daemon crash
• BZ - 789960 - guestfsd crash when try to mount non-exist disk
• BZ - 790958 - multiprovider build error: RuntimeError: link: /tmp/.guestfs-0/kernel /tmp/.guestfs-0/kernel.10139: File exists
• BZ - 795322 - add_ro should return error if not running in a config state
• BZ - 796520 - [RFE] Prevent user from running some appliance configure commands after appliance boot up
• BZ - 797760 - virt-resize on Windows XP in sysprep state causes "UNMOUNTABLE_BOOT_VOLUME" BSOD
• BZ - 798197 - virt-resize confuses format and output_format variables; using --output-format sets the input format
• BZ - 798980 - Libguestfs live support should be disabled in RHEL 6 packages
• BZ - 799695 - guestfs.h fails to compile with c++ compiler
• BZ - 799798 - set_autosync: this function can only be called in the config state at /usr/share/perl5/vendor_perl/Sys/VirtConvert/GuestfsHandle.pm line 107
• BZ - 801273 - Document for set-pgroup need to be updated
• BZ - 801788 - libguestfs holds open file descriptors when handle is launched
• BZ - 803699 - libguestfs inspection fails on Windows XP: libguestfs: error: hivex: could not locate HKLM\SYSTEM\MountedDevices
• BZ - 807557 - virt-sysprep: wrong params are passed to virt-inspector
• BZ - 807905 - mkfs blocksize option breaks when creating btrfs
• BZ - 809401 - inspection doesn't recognize Fedora 17+ (because of grub2 and UsrMove)
• BZ - 811112 - [RFE][virt-sysprep] hostname can not be changed on rhel system
• BZ - 811117 - [RFE][virt-sysprep] net-hwaddr not removed from "ifcfg-*" files on rhel
• BZ - 811673 - guestfs_last_error not set when qemu fails early during launch
• BZ - 812092 - libguestfs cannot open disk images which are symlinks to files that contain ':' (colon) character
• BZ - 813329 - virt-p2v can not convert physical host on MD device
• BZ - 831117 - CVE-2012-2690 libguestfs: virt-edit creates a new file, when it is used leading to loss of file attributes (permissions, owner, SELinux context etc.)

CVEs

• CVE-2012-2690

References

• https://access.redhat.com/security/updates/classification/#low
• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/libguestfs.html#RHSA-2012-0774