A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.

An update for spice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display system built for virtual environments which allows the user to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures.

Security Fix(es) :

* A vulnerability was discovered in spice in the server's protocol handling. An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. (CVE-2016-9577)

* A vulnerability was discovered in spice in the server's protocol handling. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash.
(CVE-2016-9578)

These issues were discovered by Frediano Ziglio (Red Hat).

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es) :

* A vulnerability was discovered in spice in the server's protocol handling. An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. (CVE-2016-9577)

* A vulnerability was discovered in spice in the server's protocol handling. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash.
(CVE-2016-9578)

These issues were discovered by Frediano Ziglio (Red Hat).

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spice package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in spice in the server's     protocol handling. An authenticated attacker could send     crafted messages to the spice server causing a heap     overflow leading to a crash or possible code execution.
    (CVE-2016-9577)

  - A vulnerability was discovered in spice in the server's     protocol handling. An attacker able to connect to the     spice server could send crafted messages which would     cause the process to crash. (CVE-2016-9578)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for rhevm-appliance is now available for RHEV 4.X RHEV-H and Agents for RHEL-7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal.

The following packages have been upgraded to a later upstream version:
rhevm-appliance (20170307.0). (BZ#1419968)

Security Fix(es) :

* A vulnerability was discovered in SPICE in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution. (CVE-2016-9577)

* A vulnerability was discovered in SPICE in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.
(CVE-2016-9578)

These issues were discovered by Frediano Ziglio (Red Hat).

Bug Fix(es) :

* Previously the name of the 'rhevm-appliance' RPM contained only a timestamp, without versioning information. In this release, the Red Hat Virtualization release will now be included in the name of the 'rhevm-appliance' RPM and will be visible from the node channel. (BZ# 1416011)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0549 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host     (4.0), imgbased (0.8.16), redhat-virtualization-host (4.0). (BZ#1410848, BZ#1430244)

    Security Fix(es):

    * A vulnerability was discovered in SPICE in the server's protocol handling. An authenticated attacker     could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible     code execution. (CVE-2016-9577)

    * A vulnerability was discovered in SPICE in the server's protocol handling. An attacker able to connect     to the SPICE server could send crafted messages which would cause the process to crash. (CVE-2016-9578)

    These issues were discovered by Frediano Ziglio (Red Hat).

    Bug Fix(es):

    * Previously, imgbased blindly copied /etc from old layers into new layers in order to keep configuration     changes between upgrades. This meant that imgbased's behavior differed from RPM, in that unmodified     configuration files would be preserved across imgbased upgrades whereas 'yum upgrade' of the same packages     would have replaced them. Now, imgbased compares the sums of files to the originals kept per-layer in     /usr/share/factory/etc so that unmodified configuration files are now handled appropriately. (BZ#1418179)

    * Previously, some earlier versions of Red Hat Virtualization Host (RHVH) repeatedly prompted for     upgrades, even when the most recent version was already installed. This was caused by the RHVH image     containing a placeholder package that was made obsolete in order to upgrade. However, the package that was     used to upgrade was not propagated to the rpmdb on the new image. Now, upgrading includes the update     package in the rpmdb on the new image. (BZ#1422476)

    * With this update, Red Hat Virtualization Host (RHVH) now includes the 'screen' package. Previously,     ovirt-hosted-engine-setup invoked from a CLI warned users that the 'screen' package was not installed.
    Though this was not an explicit requirement when using cockpit, including it provides a better experience     if using the CLI. (BZ#1403729)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3202-1 advisory.

    Frediano Ziglio discovered that Spice incorrectly handled certain client messages. A remote attacker could     use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-9577     Frediano Ziglio of Red Hat discovered a buffer overflow     vulnerability in the main_channel_alloc_msg_rcv_buf     function. An authenticated attacker can take advantage     of this flaw to cause a denial of service (spice server     crash), or possibly, execute arbitrary code.

  - CVE-2016-9578     Frediano Ziglio of Red Hat discovered that spice does     not properly validate incoming messages. An attacker     able to connect to the spice server could send crafted     messages which would cause the process to crash.

Several vulnerabilities were discovered in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2016-9577

Frediano Ziglio of Red Hat discovered a buffer overflow vulnerability in the main_channel_alloc_msg_rcv_buf function. An authenticated attacker can take advantage of this flaw to cause a denial of service (spice server crash), or possibly, execute arbitrary code.

CVE-2016-9578

Frediano Ziglio of Red Hat discovered that spice does not properly validate incoming messages. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash.

For Debian 7 'Wheezy', these problems have been fixed in version 0.11.0-1+deb7u4.

We recommend that you upgrade your spice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Add upstream patches fixing CVE-2016-9577 and CVE-2016-9578

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This security update for spice fixes the following issues :

  - CVE-2016-9577: A buffer overflow in the spice server     could have potentially been used by unauthenticated     attackers to execute arbitrary code. (bsc#1023078)

  - CVE-2016-9578: Unauthenticated attackers could have     caused a denial of service via a crafted message.
    (bsc#1023079)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This security update for spice fixes the following issues :

CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. (bsc#1023078) CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message.
(bsc#1023079)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This security update for spice fixes the following issues :

  - CVE-2016-9577: A buffer overflow in the spice server     could have potentially been used by unauthenticated     attackers to execute arbitrary code. (bsc#1023078)     CVE-2016-9578: Unauthenticated attackers could have     caused a denial of service via a crafted message.
    (bsc#1023079)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A vulnerability was discovered in spice in the server's     protocol handling. An authenticated attacker could send     crafted messages to the spice server causing a heap     overflow leading to a crash or possible code execution.
    (CVE-2016-9577)

  - A vulnerability was discovered in spice in the server's     protocol handling. An attacker able to connect to the     spice server could send crafted messages which would     cause the process to crash. (CVE-2016-9578)

An update for spice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display system built for virtual environments which allows the user to view a computing 'desktop' environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures.

Security Fix(es) :

* A vulnerability was discovered in spice in the server's protocol handling. An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. (CVE-2016-9577)

* A vulnerability was discovered in spice in the server's protocol handling. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash.
(CVE-2016-9578)

These issues were discovered by Frediano Ziglio (Red Hat).

An update for spice-server is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Simple Protocol for Independent Computing Environments (SPICE) is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine (KVM) hypervisor or on Red Hat Enterprise Virtualization Hypervisors.

Security Fix(es) :

* A vulnerability was discovered in spice in the server's protocol handling. An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. (CVE-2016-9577)

* A vulnerability was discovered in spice in the server's protocol handling. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash.
(CVE-2016-9578)

These issues were discovered by Frediano Ziglio (Red Hat).

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0254 advisory.

    - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large       messages.
      Resolves: CVE-2016-9577

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0253 advisory.

    - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large       messages.
      Resolves: CVE-2016-9577

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
101421	Virtuozzo 7 : spice-server / spice-server-devel (VZLSA-2017-0254)	Nessus	Virtuozzo Local Security Checks	high
101420	Virtuozzo 6 : spice-server / spice-server-devel (VZLSA-2017-0253)	Nessus	Virtuozzo Local Security Checks	high
99867	EulerOS 2.0 SP2 : spice (EulerOS-SA-2017-1021)	Nessus	Huawei Local Security Checks	high
97871	RHEL 7 : rhevm-appliance (RHSA-2017:0552)	Nessus	Red Hat Local Security Checks	high
97844	RHEL 7 : redhat-virtualization-host (RHSA-2017:0549)	Nessus	Red Hat Local Security Checks	high
97302	Ubuntu 14.04 LTS / 16.04 LTS : Spice vulnerabilities (USN-3202-1)	Nessus	Ubuntu Local Security Checks	high
97217	Debian DSA-3790-1 : spice - security update	Nessus	Debian Local Security Checks	high
97216	Debian DLA-825-1 : spice security update	Nessus	Debian Local Security Checks	high
97169	Fedora 25 : spice (2017-5972ebe591)	Nessus	Fedora Local Security Checks	high
97158	Fedora 24 : spice (2017-05793780f0)	Nessus	Fedora Local Security Checks	high
97078	openSUSE Security Update : spice (openSUSE-2017-228)	Nessus	SuSE Local Security Checks	high
97077	openSUSE Security Update : spice (openSUSE-2017-227)	Nessus	SuSE Local Security Checks	high
97045	SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2017:0400-1)	Nessus	SuSE Local Security Checks	high
97043	SUSE SLES11 Security Update : spice (SUSE-SU-2017:0396-1)	Nessus	SuSE Local Security Checks	high
97041	SUSE SLES12 Security Update : spice (SUSE-SU-2017:0393-1)	Nessus	SuSE Local Security Checks	high
97040	SUSE SLED12 / SLES12 Security Update : spice (SUSE-SU-2017:0392-1)	Nessus	SuSE Local Security Checks	high
97038	Scientific Linux Security Update : spice-server on SL6.x x86_64 (20170205)	Nessus	Scientific Linux Local Security Checks	high
97037	Scientific Linux Security Update : spice on SL7.x x86_64 (20170205)	Nessus	Scientific Linux Local Security Checks	high
97028	CentOS 7 : spice (CESA-2017:0254)	Nessus	CentOS Local Security Checks	high
97027	CentOS 6 : spice-server (CESA-2017:0253)	Nessus	CentOS Local Security Checks	high
97013	RHEL 7 : spice (RHSA-2017:0254)	Nessus	Red Hat Local Security Checks	high
97012	RHEL 6 : spice-server (RHSA-2017:0253)	Nessus	Red Hat Local Security Checks	high
97008	Oracle Linux 7 : spice (ELSA-2017-0254)	Nessus	Oracle Linux Local Security Checks	high
97007	Oracle Linux 6 : spice-server (ELSA-2017-0253)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2016-9578

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high