The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

An updated rhev-hypervisor6 package that fixes one security issue and various bugs is now available.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

Upgrade Note: If you upgrade the Red Hat Enterprise Virtualization Hypervisor through the 3.2 Manager administration portal, the Host may appear with the status of 'Install Failed'. If this happens, place the host into maintenance mode, then activate it again to get the host back to an 'Up' state.

A flaw was found in the way concurrent access to the clients ring buffer was performed in the spice-server library. A remote user able to initiate a SPICE connection to a guest could use this flaw to crash the guest. (CVE-2013-4130)

This issue was discovered by David Gibson of Red Hat.

This update also contains the fix from the following errata :

* vdsm: RHBA-2013:1261 https://rhn.redhat.com/errata/RHBA-2013-1261.html

Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which corrects these issues.

Multiple vulnerabilities have been found in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2013-4130     David Gibson of Red Hat discovered that SPICE     incorrectly handled certain network errors. A remote     user able to initiate a SPICE connection to an     application acting as a SPICE server could use this flaw     to crash the application.

  - CVE-2013-4282     Tomas Jamrisko of Red Hat discovered that SPICE     incorrectly handled long passwords in SPICE tickets. A     remote user able to initiate a SPICE connection to an     application acting as a SPICE server could use this flaw     to crash the application.

Applications acting as a SPICE server must be restarted for this update to take effect.

A flaw was found in the way concurrent access to the clients ring buffer was performed in the spice-server library. A remote user able to initiate a SPICE connection to an application acting as a SPICE server could use this flaw to crash the application. (CVE-2013-4130)

Applications acting as a SPICE server must be restarted for this update to take effect. Note that QEMU-KVM guests providing SPICE console access must be restarted for this update to take effect.

An updated spice-server package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

A flaw was found in the way concurrent access to the clients ring buffer was performed in the spice-server library. A remote user able to initiate a SPICE connection to an application acting as a SPICE server could use this flaw to crash the application. (CVE-2013-4130)

This issue was discovered by David Gibson of Red Hat.

Users of spice-server are advised to upgrade to this updated package, which contains a backported patch to correct this issue. Applications acting as a SPICE server must be restarted for this update to take effect. Note that QEMU-KVM guests providing SPICE console access must be restarted for this update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1192 advisory.

    [0.12.0-12.el6_4.3]
    - Fixes an abort on unsafe client ring access       Resolves: rhbz#986298

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated spice packages fix security vulnerability :

An user able to initiate spice connection to the guest could use a flaw in server/red_channel.c to crash the guest (CVE-2013-4130).

David Gibson discovered that SPICE incorrectly handled certain network errors. An attacker could use this issue to cause the SPICE server to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream bug-fix release 0.12.4

    - Fixes a client triggerable abort CVE-2013-4130

    - Add patches from upstream git to fix       sound-channel-free crash (rhbz#986407)

    - Stop building spicec, it's obsolete and superseded by       remote-viewer (part of virt-viewer)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
78972	RHEL 6 : rhev-hypervisor6 (RHSA-2013:1260)	Nessus	Red Hat Local Security Checks	medium
71867	Debian DSA-2839-1 : spice - denial of service	Nessus	Debian Local Security Checks	medium
69786	Scientific Linux Security Update : spice-server on SL6.x x86_64 (20130903)	Nessus	Scientific Linux Local Security Checks	medium
69779	CentOS 6 : spice-server (CESA-2013:1192)	Nessus	CentOS Local Security Checks	medium
69777	RHEL 6 : spice-server (RHSA-2013:1192)	Nessus	Red Hat Local Security Checks	medium
69776	Oracle Linux 6 : spice-server (ELSA-2013-1192)	Nessus	Oracle Linux Local Security Checks	high
69466	Mandriva Linux Security Advisory : spice (MDVSA-2013:217)	Nessus	Mandriva Local Security Checks	medium
69366	Ubuntu 13.04 : spice vulnerability (USN-1926-1)	Nessus	Ubuntu Local Security Checks	medium
69363	Fedora 18 : spice-0.12.4-1.fc18 (2013-14362)	Nessus	Fedora Local Security Checks	medium
69299	Fedora 19 : spice-0.12.4-1.fc19 (2013-14110)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4130

high

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium