The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

Update to new 0.12.8 upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream 0.12.8 release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice was updated to fix two security issues.

These security issues were fixed :

  - CVE-2016-2150: SPICE allowed local guest OS users to     read from or write to arbitrary host memory locations     via crafted primary surface parameters, a similar issue     to CVE-2015-5261 (boo#982385).

  - CVE-2016-0749: The smartcard interaction in SPICE     allowed remote attackers to cause a denial of service     (QEMU-KVM process crash) or possibly execute arbitrary     code via vectors related to connecting to a guest VM,     which triggers a heap-based buffer overflow     (boo#982385).

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3014-1 advisory.

    Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could     use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749)

    Frediano Ziglio discovered that Spice incorrectly handled certain primary surface parameters. A malicious     guest operating system could potentially exploit this issue to escape virtualization. (CVE-2016-2150)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

spice was updated to fix two security issues.

These security issues were fixed :

  - CVE-2016-2150: Guest escape using crafted primary     surface parameters (bsc#982386).

  - CVE-2016-0749: Heap-based buffer overflow in smartcard     interaction (bsc#982385).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice was updated to fix four security issues.

These security issues were fixed :

  - CVE-2016-2150: Guest escape using crafted primary     surface parameters (bsc#982386).

  - CVE-2016-0749: Heap-based buffer overflow in smartcard     interaction (bsc#982385).

  - CVE-2015-5260: Insufficient validation of surface_id     parameter could have caused a crash (bsc#944787).

  - CVE-2015-5261: Host memory access from guest using     crafted images (bsc#948976).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A memory allocation flaw, leading to a heap-based buffer     overflow, was found in spice's smartcard interaction,     which runs under the QEMU-KVM context on the host. A     user connecting to a guest VM using spice could     potentially use this flaw to crash the QEMU-KVM process     or execute arbitrary code with the privileges of the     host's QEMU-KVM process. (CVE-2016-0749)

  - A memory access flaw was found in the way spice handled     certain guests using crafted primary surface parameters.
    A user in a guest could use this flaw to read from and     write to arbitrary memory locations on the host.
    (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

The remote host is affected by the vulnerability described in GLSA-201606-05 (spice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in spice, please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code. Additionally, a       local attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Security Fix(es) :

  - A memory allocation flaw, leading to a heap-based buffer     overflow, was found in spice's smartcard interaction,     which runs under the QEMU-KVM context on the host. A     user connecting to a guest VM using spice could     potentially use this flaw to crash the QEMU-KVM process     or execute arbitrary code with the privileges of the     host's QEMU-KVM process. (CVE-2016-0749)

  - A memory access flaw was found in the way spice handled     certain guests using crafted primary surface parameters.
    A user in a guest could use this flaw to read from and     write to arbitrary memory locations on the host.
    (CVE-2016-2150)

An update for spice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display system built for virtual environments which allows the user to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures.

Security Fix(es) :

* A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749)

* A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es) :

* A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749)

* A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1204 advisory.

    The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for     virtual environments. SPICE users can access a virtualized desktop or server from the local system or any     system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing     virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise     Virtualization Hypervisors.

    Security Fix(es):

    * A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard     interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using     spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the     privileges of the host's QEMU-KVM process. (CVE-2016-0749)

    * A memory access flaw was found in the way spice handled certain guests using crafted primary surface     parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on     the host. (CVE-2016-2150)

    The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered     by Frediano Ziglio (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2016:1205 :

An update for spice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display system built for virtual environments which allows the user to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures.

Security Fix(es) :

* A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749)

* A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150)

The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1204 advisory.

    - Fix heap-based memory corruption within smartcard handling       Resolves: CVE-2016-0749

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-0749     Jing Zhao of Red Hat discovered a memory allocation     flaw, leading to a heap-based buffer overflow in spice's     smartcard interaction. A user connecting to a guest VM     via spice can take advantage of this flaw to cause a     denial-of-service (QEMU process crash), or potentially     to execute arbitrary code on the host with the     privileges of the hosting QEMU process.

  - CVE-2016-2150     Frediano Ziglio of Red Hat discovered that a malicious     guest inside a virtual machine can take control of the     corresponding QEMU process in the host using crafted     primary surface parameters.

ID	Name	Product	Family	Severity
93032	Fedora 23 : spice (2016-a7322c9fd1)	Nessus	Fedora Local Security Checks	critical
92443	Fedora 24 : spice (2016-6b9c658707)	Nessus	Fedora Local Security Checks	critical
91944	openSUSE Security Update : spice (openSUSE-2016-824)	Nessus	SuSE Local Security Checks	critical
91943	openSUSE Security Update : spice (openSUSE-2016-823)	Nessus	SuSE Local Security Checks	critical
91758	Ubuntu 14.04 LTS / 16.04 LTS : Spice vulnerabilities (USN-3014-1)	Nessus	Ubuntu Local Security Checks	critical
91661	SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2016:1561-1)	Nessus	SuSE Local Security Checks	critical
91659	SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2016:1559-1)	Nessus	SuSE Local Security Checks	critical
91647	Scientific Linux Security Update : spice-server on SL6.x x86_64 (20160606)	Nessus	Scientific Linux Local Security Checks	critical
91638	GLSA-201606-05 : spice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91514	Scientific Linux Security Update : spice on SL7.x x86_64 (20160606)	Nessus	Scientific Linux Local Security Checks	critical
91504	CentOS 7 : spice (CESA-2016:1205)	Nessus	CentOS Local Security Checks	critical
91503	CentOS 6 : spice-server (CESA-2016:1204)	Nessus	CentOS Local Security Checks	critical
91496	RHEL 7 : spice (RHSA-2016:1205)	Nessus	Red Hat Local Security Checks	critical
91495	RHEL 6 : spice-server (RHSA-2016:1204)	Nessus	Red Hat Local Security Checks	critical
91494	Oracle Linux 7 : spice (ELSA-2016-1205)	Nessus	Oracle Linux Local Security Checks	critical
91493	Oracle Linux 6 : spice-server (ELSA-2016-1204)	Nessus	Oracle Linux Local Security Checks	critical
91490	Debian DSA-3596-1 : spice - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-0749

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical