CVE-2011-1773 Auth bypass in n/a
Local attackers can bypass VNC authentication on converted guests by connecting without a password due to missing password preservation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1773?
CVE-2011-1773 is a medium-severity authentication bypass vulnerability in Redhat Enterprise Linux, published on 8 Feb 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
virt-v2v before 0.8.4 does not preserve the VNC console password when converting a guest, which allows local users to bypass the intended VNC authentication by connecting without a password.
Weakness: CWE-255
Which versions are affected by CVE-2011-1773?
It affects 2 products.
Linux distribution packages (4)
virt-v2v Red Hat:enterprise_linux:6::client | All versions | 0:0.8.3-5.el6 |
virt-v2v Red Hat:enterprise_linux:6::computenode | All versions | 0:0.8.3-5.el6 |
virt-v2v Red Hat:enterprise_linux:6::server | All versions | 0:0.8.3-5.el6 |
virt-v2v Red Hat:enterprise_linux:6::workstation | All versions | 0:0.8.3-5.el6 |
Products include Matthew Booth Virt-V2v, Redhat Enterprise Linux.
How do I fix CVE-2011-1773?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2011-1773 being exploited?
There is no known exploitation of CVE-2011-1773 in the wild and no public exploit code.
Sources
Also known as GHSA-pv82-4539-jh36, RHSA-2011:1615.