CVE Vulnerability

CVE-2008-1945

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

2.1 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

References
Link Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2008:162 Third Party Advisory
http://www.securityfocus.com/bid/30604 Third Party Advisory VDB Entry
http://secunia.com/advisories/32063 Third Party Advisory
http://secunia.com/advisories/32088 Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2008-0892.html Third Party Advisory
http://www.securitytracker.com/id?1020959 Third Party Advisory VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html Mailing List Third Party Advisory
http://secunia.com/advisories/34642 Third Party Advisory
http://secunia.com/advisories/35031 Third Party Advisory
http://www.debian.org/security/2009/dsa-1799 Third Party Advisory
http://www.ubuntu.com/usn/usn-776-1 Third Party Advisory
http://secunia.com/advisories/35062 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44269 Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9905 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:qemu:qemu:0.9.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:-:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:5.2:*:*:*:*:*:*:*
Information

Published : 2008-08-08 07:41

Updated : 2020-12-16 12:34

NVD link : CVE-2008-1945

Mitre link : CVE-2008-1945

Products Affected
No products.
CWE
NVD-CWE-noinfo