CVE-2013-2007

Published: 21 May 2013

The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.

Notes

qemu guest agent is shipped in qemu-kvm binary package in
precise. It's not built in quantal. It's in the qemu-guest-agent
package in raring+

I didn't see the qga.c or related files in xen-3.3 or xen packages

although we shipped the guest agent in the precise qemu-kvm
package, we did not ship any init script. Users of this tool
are advised to configure it to creates files in directories
with appropriate permissions.
we will not be releasing an update for precise.

Status

References

• http://xforce.iss.net/xforce/xfdb/84047
• http://www.securitytracker.com/id/1028521
• http://www.openwall.com/lists/oss-security/2013/05/06/5
• http://secunia.com/advisories/53325
• http://osvdb.org/93032
• https://www.cve.org/CVERecord?id=CVE-2013-2007
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=956082