Detections
Analytics
SuSE 11.3 Security Update : kvm (SAT Patch Number 9739)
high Nessus Plugin ID 78105
Language:
Synopsis
The remote SuSE 11 host is missing a security update.Description
kvm has been updated to fix issues in the embedded qemu :- An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could have used this flaw to corrupt QEMU process memory on the host, which could potentially have resulted in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2014-0223)
- A user able to alter the savevm data (either on the disk or over the wire during migration) could have used this flaw to to corrupt QEMU process memory on the (destination) host, which could have potentially resulted in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2014-3461)
- An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could have used this flaw to corrupt QEMU process memory on the host, which could have potentially resulted in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2014-0222)
Non-security bugs fixed :
- Fix exceeding IRQ routes that could have caused freezes of guests. (bnc#876842)
- Fix CPUID emulation bugs that may have broken Windows guests with newer -cpu types (bnc#886535)
Solution
Apply SAT patch number 9739.See Also
https://bugzilla.novell.com/show_bug.cgi?id=876842
https://bugzilla.novell.com/show_bug.cgi?id=877642
https://bugzilla.novell.com/show_bug.cgi?id=877645
https://bugzilla.novell.com/show_bug.cgi?id=878541
https://bugzilla.novell.com/show_bug.cgi?id=886535
http://support.novell.com/security/cve/CVE-2014-0222.html
Plugin Details
Severity: High
ID: 78105
File Name: suse_11_kvm-140919.nasl
Version: 1.5
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 10/9/2014
Updated: 1/19/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:novell:suse_linux:11, p-cpe:/a:novell:suse_linux:11:kvm
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Patch Publication Date: 9/19/2014