CVE-2011-1773

Severity: medium (CVSS 4.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-02-08 · updated 2026-06-16
Weakness: CWE-255

Description

virt-v2v before 0.8.4 does not preserve the VNC console password when converting a guest, which allows local users to bypass the intended VNC authentication by connecting without a password.

Affected products

Matthew Booth Virt-V2V: through 0.8.3; 0.1.0, 0.2.0, 0.3.0, 0.3.2, 0.4.0, 0.4.9 (+15)
Red Hat Enterprise Linux: 6.0

References

http://rhn.redhat.com/errata/RHSA-2011-1615.html
http://secunia.com/advisories/47086
http://www.osvdb.org/77558
https://bugzilla.redhat.com/show_bug.cgi?id=702754
https://git.fedorahosted.org/cgit/virt-v2v.git/commit/?id=7e9393129116699d1228bb02b9f65b78584582c1
http://rhn.redhat.com/errata/RHSA-2011-1615.html
http://secunia.com/advisories/47086
http://www.osvdb.org/77558
https://bugzilla.redhat.com/show_bug.cgi?id=702754
https://git.fedorahosted.org/cgit/virt-v2v.git/commit/?id=7e9393129116699d1228bb02b9f65b78584582c1

Get alerted when CVE-2011-1773 or the next vulnerability affects your stack