The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2745-1 advisory.

    Lian Yihan discovered that QEMU incorrectly handled certain payload messages in the VNC display driver. A     malicious guest could use this issue to cause the QEMU process to hang, resulting in a denial of service.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-5239)

    Qinghao Tang discovered that QEMU incorrectly handled receiving certain packets in the NE2000 network     driver. A malicious guest could use this issue to cause the QEMU process to hang, resulting in a denial of     service. (CVE-2015-5278)

    Qinghao Tang discovered that QEMU incorrectly handled receiving certain packets in the NE2000 network     driver. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary     code on the host as the user running the QEMU process. In the default installation, when QEMU is used with     libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2015-5279)

    Qinghao Tang discovered that QEMU incorrectly handled transmit descriptor data when sending network     packets. A malicious guest could use this issue to cause the QEMU process to hang, resulting in a denial     of service. (CVE-2015-6815)

    Qinghao Tang discovered that QEMU incorrectly handled ATAPI command permissions. A malicious guest could     use this issue to cause the QEMU process to crash, resulting in a denial of service. (CVE-2015-6855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2745-1)

high Nessus Plugin ID 86146

Version 2.14