Detections
Analytics

Mandriva Linux Security Advisory : qemu (MDVSA-2013:121)

high Nessus Plugin ID 66133

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Updated qemu packages fix security vulnerability :

A flaw was found in how qemu, in snapshot mode (-snapshot command line argument), handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only image and the current state. In snapshot mode, bdrv_open() creates an empty temporary file without checking for any mkstemp() or close() failures;
it also ignores the possibility of a buffer overrun given an exceptionally long /tmp. Because qemu re-opens that file after creation, it is possible to race qemu and insert a symbolic link with the same expected name as the temporary file, pointing to an attacker-chosen file. This can be used to either overwrite the destination file with the privileges of the user running qemu (typically root), or to point to an attacker-readable file that could expose data from the guest to the attacker (CVE-2012-2652).

A flaw was found in the way QEMU handled VT100 terminal escape sequences when emulating certain character devices. A guest user with privileges to write to a character device that is emulated on the host using a virtual console back-end could use this flaw to crash the qemu-kvm process on the host or, possibly, escalate their privileges on the host (CVE-2012-3515).

It was discovered that the e1000 emulation code in QEMU does not enforce frame size limits in the same way as the real hardware does.
This could trigger buffer overflows in the guest operating system driver for that network card, assuming that the host system does not discard such frames (which it will by default) (CVE-2012-6075).

Solution

Update the affected qemu and / or qemu-img packages.

Plugin Details

Severity: High

ID: 66133

File Name: mandriva_MDVSA-2013-121.nasl

Version: 1.7

Type: local

Published: 4/20/2013

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:qemu, cpe:/o:mandriva:business_server:1, p-cpe:/a:mandriva:linux:qemu-img

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 4/10/2013

Reference Information

CVE: CVE-2012-2652, CVE-2012-3515, CVE-2012-6075

BID: 53725, 55413, 57420

MDVSA: 2013:121

MGASA: 2012-0185, 2012-0263, 2013-0025