CVE-2015-6927

View on CVE.org

Published Sep 28, 2015 CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Description

vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:openvz:vzctl:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2015-6861	vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.502% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.debian.org/security/2015/dsa-3357
https://openvz.org/Download/vzctl/4.9.4
https://security.gentoo.org/glsa/201701-30
https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c

History

No history.

Subscriptions

Openvz Vzctl

Weaknesses

CWE-59

Sources

CVE record Updated: Aug 6, 2024, 7:36 AM

Status: PUBLISHED
Assigner: mitre
Published: Sep 28, 2015, 8:00 PM
Updated: Aug 6, 2024, 7:36 AM
Reserved: Sep 14, 2015, 12:00 AM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 17, 2026, 12:31 AM

Status: Modified
Published: Sep 28, 2015, 8:59 PM
Modified: Jun 17, 2026, 12:31 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-09-13T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://openvz.org/Download/vzctl/4.9.4"}, {"name": "GLSA-201701-30", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201701-30"}, {"name": "DSA-3357", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3357"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-6927", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://openvz.org/Download/vzctl/4.9.4", "refsource": "CONFIRM", "url": "https://openvz.org/Download/vzctl/4.9.4"}, {"name": "GLSA-201701-30", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201701-30"}, {"name": "DSA-3357", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3357"}, {"name": "https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c", "refsource": "CONFIRM", "url": "https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T07:36:34.589Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://openvz.org/Download/vzctl/4.9.4"}, {"name": "GLSA-201701-30", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201701-30"}, {"name": "DSA-3357", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3357"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-6927", "datePublished": "2015-09-28T20:00:00.000Z", "dateReserved": "2015-09-14T00:00:00.000Z", "dateUpdated": "2024-08-06T07:36:34.589Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openvz:vzctl:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6A0E965-E5F7-4C3E-B2DF-3D1BB04569AF", "versionEndIncluding": "4.9.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel."}, {"lang": "es", "value": "Vulnerabilidad en vzctl en versiones anteriores a 4.9.4, determina la estructura del entorno virtual (VE) bas\u00e1ndose en la presencia de root.hdd/DiskDescriptor.xml en el directorio privado VE, lo que permite a los usuarios root del contenedor (CT) simfs local cambiar la contrase\u00f1a de root para contenedores ploop arbitrarios, seg\u00fan lo demostrado por un ataque de enlaces simb\u00f3licos en el contenedor ploop del archivo root.hdd y accediendo entonces a un panel de control."}], "id": "CVE-2015-6927", "lastModified": "2026-06-17T00:31:36.120", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-09-28T20:59:09.017", "references": [{"source": "cve@mitre.org", "url": "http://www.debian.org/security/2015/dsa-3357"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://openvz.org/Download/vzctl/4.9.4"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201701-30"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3357"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://openvz.org/Download/vzctl/4.9.4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201701-30"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}