qemu update to version 0.10.1 fixes the following security issues :

CVE-2008-0928: problems with range checks of block devices CVE-2008-1945: problems with removable media handling CVE-2008-2382:
vnc server DoS CVE-2008-4539: fix a heap overflow in the cirrus VGA implementation CVE-2008-5714: off by one error in vnc password handling

Avi Kivity discovered that KVM did not correctly handle certain disk formats. A local attacker could attach a malicious partition that would allow the guest VM to read files on the VM host. (CVE-2008-1945, CVE-2008-2004)

Alfredo Ortega discovered that KVM's VNC protocol handler did not correctly validate certain messages. A remote attacker could send specially crafted VNC messages that would cause KVM to consume CPU resources, leading to a denial of service. (CVE-2008-2382)

Jan Niehusmann discovered that KVM's Cirrus VGA implementation over VNC did not correctly handle certain bitblt operations. A local attacker could exploit this flaw to potentially execute arbitrary code on the VM host or crash KVM, leading to a denial of service.
(CVE-2008-4539)

It was discovered that KVM's VNC password checks did not use the correct length. A remote attacker could exploit this flaw to cause KVM to crash, leading to a denial of service. (CVE-2008-5714).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-776-1 fixed vulnerabilities in KVM. Due to an incorrect fix, a regression was introduced in Ubuntu 8.04 LTS that caused KVM to fail to boot virtual machines started via libvirt. This update fixes the problem. We apologize for the inconvenience.

Avi Kivity discovered that KVM did not correctly handle certain disk formats. A local attacker could attach a malicious partition that would allow the guest VM to read files on the VM host. (CVE-2008-1945, CVE-2008-2004)

Alfredo Ortega discovered that KVM's VNC protocol handler did not correctly validate certain messages. A remote attacker could send specially crafted VNC messages that would cause KVM to consume CPU resources, leading to a denial of service. (CVE-2008-2382)

Jan Niehusmann discovered that KVM's Cirrus VGA implementation over VNC did not correctly handle certain bitblt operations. A local attacker could exploit this flaw to potentially execute arbitrary code on the VM host or crash KVM, leading to a denial of service. (CVE-2008-4539)

It was discovered that KVM's VNC password checks did not use the correct length. A remote attacker could exploit this flaw to cause KVM to crash, leading to a denial of service.
(CVE-2008-5714).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the QEMU processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0928     Ian Jackson discovered that range checks of file     operations on emulated disk devices were insufficiently     enforced.

  - CVE-2008-1945     It was discovered that an error in the format auto     detection of removable media could lead to the     disclosure of files in the host system.

  - CVE-2008-4539     A buffer overflow has been found in the emulation of the     Cirrus graphics adaptor.

----------------------------------------------------------------------
---------- ChangeLog :

  - Mon Dec 22 2008 Glauber Costa <gcosta at redhat.com> -     65-15.fc9

    - Fixed CVE-2008-2382.

    - Thu Dec 4 2008 Glauber Costa <gcosta at redhat.com> -       65-14.fc9

    - Fixed bug that corrupted gnome-panel #474702

    - Tue Dec 2 2008 Glauber Costa <gcosta at redhat.com> -       65-12.fc9

    - Properly set flags for interrupt return #464304

    - Tue Nov 11 2008 Glauber Costa <gcosta at redhat.com> -       65-11.fc9

    - Fix CVE-2008-4539 #448525

    - Mon Oct 13 2008 Glauber Costa <gcosta at redhat.com> -       65-10.fc9

    - Fix sysenter save in 64-bit hosts #457649

    - Thu Aug 28 2008 Glauber Costa <gcosta at redhat.com> -       65-9.fc9

    - there's already a 65-8 tag

    - Thu Aug 28 2008 Glauber Costa <gcosta at redhat.com> -       65-8.fc9

    - Fixes #459778

    - Fixes #452355

    - Tue May 27 2008 Glauber Costa <gcosta at redhat.com> -       65-7.fc9

    - Fix the build

    - Tue May 27 2008 Glauber Costa <gcosta at redhat.com> -       65-6.fc9

    - Fix Cirrus heap overflow vulnerability (#448525)

    - Fri May 23 2008 Daniel P. Berrange <berrange at       redhat.com> - 65-5.fc9

    - Put PTY in rawmode

    - Tue May 20 2008 Mark McLoughlin <markmc at redhat.com>
      - 65-4.fc9

    - Re-enable patch to fix -kernel with virtio/extboot       drives (#444578)

    - Fri May 16 2008 Glauber Costa <gcosta at redhat.com> -       65-3.fc9

    - Fix problem with cirrus device that was breaking vnc       connections (rhbz #446830)

    - Tue Apr 29 2008 Mark McLoughlin <markmc at redhat.com>
      - 65-2

    - Fix -kernel with virtio/extboot drives (#444578)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aurelien Jarno reports :

CVE-2008-4539: fix a heap overflow in Cirrus emulation

The code in hw/cirrus_vga.c has changed a lot between CVE-2007-1320 has been announced and the patch has been applied. As a consequence it has wrongly applied and QEMU is still vulnerable to this bug if using VNC.

ID	Name	Product	Family	Published	Updated	Severity
36082	openSUSE 10 Security Update : qemu (qemu-6123)	Nessus	SuSE Local Security Checks	4/3/2009	1/14/2021	high
38759	Ubuntu 8.04 LTS / 8.10 : kvm vulnerabilities (USN-776-1)	Nessus	Ubuntu Local Security Checks	5/13/2009	1/19/2021	high
38777	Ubuntu 8.04 LTS : kvm regression (USN-776-2)	Nessus	Ubuntu Local Security Checks	5/14/2009	1/19/2021	high
40118	openSUSE Security Update : qemu (qemu-691)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	high
38747	Debian DSA-1799-1 : qemu - several vulnerabilities	Nessus	Debian Local Security Checks	5/13/2009	1/4/2021	high
35266	Fedora 9 : kvm-65-15.fc9 (2008-11705)	Nessus	Fedora Local Security Checks	12/26/2008	1/11/2021	high
34685	FreeBSD : qemu -- Heap overflow in Cirrus emulation (07bb3bd2-a920-11dd-8503-0211060005df)	Nessus	FreeBSD Local Security Checks	11/3/2008	1/6/2021	high
40302	openSUSE Security Update : qemu (qemu-691)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high