oss-security - CVE request -- virt-v2v: vnc password protection is missing after vm conversion

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 6 May 2011 22:53:42 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley@...us.mitre.org
Subject: CVE request -- virt-v2v: vnc password protection is missing after
	vm conversion

Hello Steve, vendors.

Description:
It was found that after virtual machine conversion using virt-v2v the
target VM does not have VNC password enabled even though the source VM does.
An attacker able to connect to the target VM can possibly use this flaw to
operate the VM with privileges of the logged in user.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=702754

Could you please allocate a CVE identifier for this issue?

Thanks you,
--
Petr Matousek / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.