Libvirt Security Notice: LSN-2016-0001

Authentication disabled when setting empty VNC password

Lifecycle

Credits

See also

• CVE-2016-5008

Description

An empty password set for the VNC server is documented as preventing all client connections. This is the behaviour when QEMU virtual machines are first started with the 'password' flag given to the -vnc argument and when setting the password with the 'change vnc' monitor command. When libvirt switched to using 'set_password' QMP command though using an empty password had the effect of disabling password checking and thus allowing any client connection with no authentication check.

Impact

When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled allowing any user to connect. An application would meanwhile expect that the empty string would prevent all users from connecting

Workaround

The VNC password authentication scheme is generally considered to offer inadequate security, so its use is not recommended at all, regardless of this vulnerability. Applications and administrators are thus encouraged to make use of the VNC TLS extension together with SASL for strong authentication.

Affected product: libvirt

Alternative formats: [xml] [text]