CVE-2016-5008

What it actually does

The flaw causes libvirt to skip password validation entirely for VNC servers when the configured password is the empty string, allowing any remote client to establish an unauthenticated VNC session to a virtual machine console.

Why it matters to the business

Attackers can obtain direct interactive access to virtual machine consoles in affected virtualization environments, increasing the risk of data exposure, lateral movement, and operational disruption until systems are updated.

How an attack unfolds

An attacker locates publicly reachable VNC ports on hosts running vulnerable libvirt, initiates a standard VNC client connection, and is granted immediate session access because the empty-password code path disables all authentication checks.

How to fix it

Upgrade libvirt to version 2.0.0 or later on all affected systems; after upgrade, audit domain XML configurations and either set non-empty VNC passwords or disable VNC listeners entirely.

How to confirm the fix worked

Confirm installed libvirt version is 2.0.0 or newer; attempt a VNC connection to a test domain configured with an empty password and verify that authentication is now enforced or the listener is disabled.

Typical attack path

1. Scan for open VNC ports on hosts using libvirt-managed virtualization
2. Connect with a standard VNC client to the discovered port
3. Trigger the empty-password code path that bypasses authentication
4. Obtain interactive console access to the target virtual machine

How to detect it

Review libvirt logs and domain XML files for empty VNC password settings; inspect network logs for inbound connections to VNC ports from unexpected sources; correlate with process execution of libvirtd versions older than 2.0.0.

• libvirt version before 2.0.0
• <graphics type='vnc' port='-' autoport='yes' passwd=''
• vnc connection accepted without password in libvirtd.log
• unexpected VNC TCP sessions to ports 5900-59xx

What your security team should do

• Prioritize upgrade of libvirt to 2.0.0+ across all virtualization hosts
• Scan domain configurations for empty or missing VNC passwords and remediate
• Restrict network exposure of VNC ports using firewalls or libvirt TLS
• Enable logging of VNC connection attempts for ongoing monitoring