bugtraq - [ MDVSA-2013:121 ] qemu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1UPwKa-0004TA-Pk@titan.mandriva.com>
Date: Wed, 10 Apr 2013 16:49:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2013:121 ] qemu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2013:121
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : qemu
 Date    : April 10, 2013
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated qemu packages fix security vulnerability:

 A flaw was found in how qemu, in snapshot mode (-snapshot command
 line argument), handled the creation and opening of the temporary
 file used to store the difference of the virtualized guest&#039;s read-only
 image and the current state. In snapshot mode, bdrv_open() creates an
 empty temporary file without checking for any mkstemp() or close()
 failures; it also ignores the possibility of a buffer overrun
 given an exceptionally long /tmp. Because qemu re-opens that file
 after creation, it is possible to race qemu and insert a symbolic
 link with the same expected name as the temporary file, pointing
 to an attacker-chosen file. This can be used to either overwrite
 the destination file with the privileges of the user running qemu
 (typically root), or to point to an attacker-readable file that could
 expose data from the guest to the attacker (CVE-2012-2652).

 A flaw was found in the way QEMU handled VT100 terminal escape
 sequences when emulating certain character devices. A guest user
 with privileges to write to a character device that is emulated on
 the host using a virtual console back-end could use this flaw to
 crash the qemu-kvm process on the host or, possibly, escalate their
 privileges on the host (CVE-2012-3515).

 It was discovered that the e1000 emulation code in QEMU does not
 enforce frame size limits in the same way as the real hardware
 does. This could trigger buffer overflows in the guest operating system
 driver for that network card, assuming that the host system does not
 discard such frames (which it will by default) (CVE-2012-6075).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6075
 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0185
 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0263
 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0025
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 2077322ff415a0f63921650be5b4d7fa  mbs1/x86_64/qemu-1.0-8.1.mbs1.x86_64.rpm
 a4741d08a3dedd1007296ac535ecce83  mbs1/x86_64/qemu-img-1.0-8.1.mbs1.x86_64.rpm 
 4e9cead8b0e57eec5c5e36abf0318efa  mbs1/SRPMS/qemu-1.0-8.1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFRZVG5mqjQ0CJFipgRAvdbAKDuC2ZxrYAhBiDajUFvXh7qGODENACeLK+a
A9jU52eEUkylFSSyud9MeM4=
=RVuM
-----END PGP SIGNATURE-----