full-disclosure - [USN-863-1] QEMU vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 3 Dec 2009 14:01:04 -0600
From: Jamie Strandboge <jamie@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-863-1] QEMU vulnerability

===========================================================
Ubuntu Security Notice USN-863-1          December 03, 2009
qemu-kvm vulnerability
https://launchpad.net/bugs/458521
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  qemu-kvm                        0.11.0-0ubuntu6.3

After a standard system upgrade you need to restart any QEMU guests to
effect the necessary changes.

Details follow:

It was discovered that QEMU did not properly setup the virtio networking
features available to its guests. A remote attacker could exploit this to
crash QEMU guests which use virtio networking on Linux kernels earlier
than 2.6.26.


Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3.diff.gz
      Size/MD5:    48984 14fa43af0ed17b918c50803f91b1480d
    http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3.dsc
      Size/MD5:     1377 18f25eed2408085a81ad70f39d74a835
    http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0.orig.tar.gz
      Size/MD5:  4382897 440837a062967102a68e634d57eaf719

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.3_amd64.deb
      Size/MD5:     9106 b15b1b8a62f13822a3932abd54a5f924
    http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3_amd64.deb
      Size/MD5:  2813520 49b26fe83d6c4a5c9befd6716a3431a9
    http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.3_amd64.deb
      Size/MD5:   636074 d9f0b9d5ff621c8b56b9fca53c0ae5d2
    http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.3_amd64.deb
      Size/MD5: 15469258 dd6a9beb5c7d51b43785df232a3a3c40
    http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.3_amd64.deb
      Size/MD5:     8560 2bb181fcf769aafd08d26aa531bb24a4

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.3_i386.deb
      Size/MD5:     9104 0a0a8a786ad29625fe5aa3de79c5cd98
    http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3_i386.deb
      Size/MD5:  2592100 3023e22d5e6b3ff51fcf3641cd039e93
    http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.3_i386.deb
      Size/MD5:   558556 5d369da01ec40b1d79b7e015d9982302
    http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.3_i386.deb
      Size/MD5: 13984728 5464f6de725b919cdb4bd7252d221016
    http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.3_i386.deb
      Size/MD5:     8562 3e34c884aff529f95a2975cdb08b2723

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.3_lpia.deb
      Size/MD5:     9104 156a8ede19f2d65929e73f119415f1b7
    http://ports.ubuntu.com/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.3_lpia.deb
      Size/MD5:  2621316 02b4e9168fdacc9ab8955de557c64a7d
    http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.3_lpia.deb
      Size/MD5:   578522 eb5a953dc2d59c2893656467bc879c25
    http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.3_lpia.deb
      Size/MD5: 14110238 ee2d23ca2c7d25f37e5cb4d315730ad4
    http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.3_lpia.deb
      Size/MD5:     8560 7c2df17d8e67444172c9093c28a01d71



Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/