CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 8.5
CWE Name:  Permissions Privileges and Access Controls
Summary: the virconnectdomainxmltonative api function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute qemu binaries via crafted xml.  note: some of these details are obtained from third party information.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2013-11-02
Last Modified Date: 2015-01-02