This bug was fixed in the package qemu-kvm - 0.12.5+noroms-0ubuntu7.2
---------------
qemu-kvm (0.12.5+noroms-0ubuntu7.2) maverick-security; urgency=low
[ Dustin Kirkland ]
* SECURITY UPDATE: Setting VNC password to empty string silently
disables all authentication (LP: #697197).
- debian/patches/697197-fix-vnc-password-semantics.patch: Reverses the
change introduced in Qemu by git commit 52c18be9, thanks to Neil Wilson.
- CVE-2011-0011
[ Kees Cook ]
* debian/rules: disable parallel build; fix FTBFS.
-- Kees Cook <k...@ubuntu.com> Fri, 11 Feb 2011 15:52:12 -0800
** Changed in: qemu-kvm (Ubuntu Maverick)
Status: Fix Committed => Fix Released
** Changed in: qemu-kvm (Ubuntu Lucid)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/697197
Title:
Empty password allows access to VNC in libvirt
Status in libvirt virtualization API:
Unknown
Status in QEMU:
Confirmed
Status in qemu-kvm:
Unknown
Status in “libvirt” package in Ubuntu:
Invalid
Status in “qemu-kvm” package in Ubuntu:
Fix Released
Status in “libvirt” source package in Lucid:
Invalid
Status in “qemu-kvm” source package in Lucid:
Fix Released
Status in “libvirt” source package in Maverick:
Invalid
Status in “qemu-kvm” source package in Maverick:
Fix Released
Status in “libvirt” source package in Natty:
Invalid
Status in “qemu-kvm” source package in Natty:
Fix Released
Status in “libvirt” source package in Karmic:
Invalid
Status in “qemu-kvm” source package in Karmic:
Fix Released
Bug description:
The help in the /etc/libvirt/qemu.conf states
"To allow access without passwords, leave this commented out. An empty
string will still enable passwords, but be rejected by QEMU
effectively preventing any use of VNC."
yet setting:
vnc_password=""
allows access to the vnc console without any password prompt just as
if it is hashed out completely.
ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: libvirt-bin 0.8.3-1ubuntu14
ProcVersionSignature: Ubuntu 2.6.35-24.42-server 2.6.35.8
Uname: Linux 2.6.35-24-server x86_64
Architecture: amd64
Date: Tue Jan 4 12:18:35 2011
InstallationMedia: Ubuntu-Server 10.04.1 LTS "Lucid Lynx" - Release amd64
(20100816.2)
ProcEnviron:
LANG=en_GB.UTF-8
SHELL=/bin/bash
SourcePackage: libvirt
