CVE-2016-5008

Synopsis Moderate: libvirt security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for libvirt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sy ...

Several security issues were fixed in libvirt ...

Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user to connect, despite the documentation declaring that ...

It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it allowed access with no authentication required An attacker could use this flaw to access a VNC server with an empty VNC password without any authentication ...