Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Sign up!
EnGarde Community
What is the most important Linux security technology?
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Latest Newsletters
Linux Advisory Watch: March 27th, 2015
Linux Security Week: March 23rd, 2015
LinuxSecurity Newsletters
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

Ubuntu: 1063-1: QEMU vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Ubuntu Neil Wilson discovered that if VNC passwords were blank in QEMUconfigurations, access to VNC sessions was allowed without a passwordinstead of being disabled. A remote attacker could connect to runningVNC sessions of QEMU and directly control the system. By default, QEMUdoes not start VNC sessions. [More...]
Ubuntu Security Notice USN-1063-1         February 14, 2011
qemu-kvm vulnerability

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  kvm                             0.11.0-0ubuntu6.4
  qemu                            0.11.0-0ubuntu6.4
  qemu-arm-static                 0.11.0-0ubuntu6.4
  qemu-kvm                        0.11.0-0ubuntu6.4
  qemu-kvm-extras                 0.11.0-0ubuntu6.4

Ubuntu 10.04 LTS:
  kvm                             0.12.3+noroms-0ubuntu9.4
  qemu                            0.12.3+noroms-0ubuntu9.4
  qemu-arm-static                 0.12.3+noroms-0ubuntu9.4
  qemu-common                     0.12.3+noroms-0ubuntu9.4
  qemu-kvm                        0.12.3+noroms-0ubuntu9.4
  qemu-kvm-extras                 0.12.3+noroms-0ubuntu9.4
  qemu-kvm-extras-static          0.12.3+noroms-0ubuntu9.4

Ubuntu 10.10:
  kvm                             0.12.5+noroms-0ubuntu7.2
  qemu                            0.12.5+noroms-0ubuntu7.2
  qemu-arm-static                 0.12.5+noroms-0ubuntu7.2
  qemu-kvm                        0.12.5+noroms-0ubuntu7.2
  qemu-kvm-extras                 0.12.5+noroms-0ubuntu7.2
  qemu-kvm-extras-static          0.12.5+noroms-0ubuntu7.2

After a standard system update you need to restart any running QEMU sessions
to make all the necessary changes.

Details follow:

Neil Wilson discovered that if VNC passwords were blank in QEMU
configurations, access to VNC sessions was allowed without a password
instead of being disabled. A remote attacker could connect to running
VNC sessions of QEMU and directly control the system. By default, QEMU
does not start VNC sessions.

Updated packages for Ubuntu 9.10:

  Source archives:
      Size/MD5:    49951 b1eb8586a033e224d929ffee2f372e7b
      Size/MD5:     2056 ce3fa0319c9d0c0f07c5264d1c89f4aa
      Size/MD5:  4382897 440837a062967102a68e634d57eaf719

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):
      Size/MD5:     9268 77a356214c0573a0cad03a590f3abc39
      Size/MD5:  2813560 3917642c38b4e4eb87c34c2defaba0a6
      Size/MD5:   636276 35dcc645220981dd2b21d4b6f6fcfe98
      Size/MD5: 15469464 0e0cf0c3cb235b03dfe2f871935fc24d
      Size/MD5:     8724 d5ce47a96404c1bc774f0381871a73d3

  i386 architecture (x86 compatible Intel/AMD):
      Size/MD5:     9264 e7fd0bb4ffc6ee6a0af381963dc38db7
      Size/MD5:  2592266 0d0574ef0726f86b9a9c0c0ee825a4b7
      Size/MD5:   558988 bb3e361f0b739fa47e23348eea83c0b2
      Size/MD5: 13984592 4a5bad4d141286b9730aee17e8e7f601
      Size/MD5:     8726 e6118d53d74abca674bf097d368da333

  lpia architecture (Low Power Intel Architecture):
      Size/MD5:     9266 c6876667f4913ed354cf856208357d5c
      Size/MD5:  2621292 7c38852bf5ae9f51a5b72ab419162c44
      Size/MD5:   578778 a2ab4d647e97f543b54bda1914eb3456
      Size/MD5: 14110322 cae30bd890e32b1dad2c12be0063d429
      Size/MD5:     8720 effdfd7814e75becc5317f30624f3131

Updated packages for Ubuntu 10.04 LTS:

  Source archives:
      Size/MD5:    59055 ddd620576dad48286d6844784606f663
      Size/MD5:     2195 0cfe7be7ae0d42394c7faa4d7b14cd4d
      Size/MD5:  3855993 3d06a46426bf2e9d13c271532e128155

  Architecture independent packages:
      Size/MD5:    29614 db3d44856d4abca79224bc3c75d8a107

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):
      Size/MD5:    14688 c6b47811b8500acd877067d46ccea77c
      Size/MD5:  2952078 13d4bfa4883e4868222b46cec34cdbf3
      Size/MD5:    14234 a0fd5588781d377a701224241bedde0a
      Size/MD5: 11183532 de3f7e009353e6f0eca9bba6c745afa2
      Size/MD5: 16943070 056670a82ab408912444af029156df9e
      Size/MD5:    14082 a85a7e312b308bd60041aec0a6aaab0e

  i386 architecture (x86 compatible Intel/AMD):
      Size/MD5:    14690 ed7b59c87f0a24390c250ceaaff57587
      Size/MD5:  2557370 cbff84fc36b0af7ad84ed6945fd4270f
      Size/MD5:    14236 b8951772f70aa22d0a9a81a2a4102f91
      Size/MD5:  8926712 40f7dd7ec241ce0521442839e29f7098
      Size/MD5: 14483128 667bfa9b046cba5470961abe0222b8b6
      Size/MD5:    14074 0491a031d555399f5a67a2b8f1d1fb27

  armel architecture (ARM Architecture):
      Size/MD5:    14696 ba439027498f93ef1f0de2b80e932137
      Size/MD5: 15352518 f23a678eecc1046f83d7d48ef419aa7f
      Size/MD5:    14084 4beb4cd934c0a504a29b84fd5e8cc56d

  powerpc architecture (Apple Macintosh G3/G4/G5):
      Size/MD5:    14690 ec59a9867512187e7c25d942b315e498
      Size/MD5:  2878074 eb7f446a8fc88686e60cdc4622a60596
      Size/MD5: 16044010 e35c6be48ca03d4c73abb8f47c2782ba
      Size/MD5:    14078 44aaec5fe491fd6028b257b8c4b44553

  sparc architecture (Sun SPARC/UltraSPARC):
      Size/MD5:    42850 5e211af4450bba271debdc8539451c31
      Size/MD5:    14074 bebc621f4091c9a35dbc0f6b68a25983

Updated packages for Ubuntu 10.10:

  Source archives:
      Size/MD5:    59296 62995fbdb4c625defd2e4f2f7cc97b14
      Size/MD5:     2221 3d97883f347516f5aefc59fa96919569
      Size/MD5:  4722351 c7303c30432dc4eb0a39bb85a9d15cc9

  Architecture independent packages:
      Size/MD5:    31566 a3de989fa047a4267df2aea092e8c009

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):
      Size/MD5:    16050 3862d4b962732b539d8b25b069e156ee
      Size/MD5:  2957096 69bc0a937f2e04ca32c09732dc191453
      Size/MD5:    15680 5dad6903eb7aa01d25360170306ab330
      Size/MD5: 11168302 91bc79c088eaad99c7a49383893c2fdc
      Size/MD5: 16957714 ff9c39105e09c6a4102c3cf3dbf3107a
      Size/MD5:    15524 8273e72ea1150187c776c8dac8ed2488

  i386 architecture (x86 compatible Intel/AMD):
      Size/MD5:    16044 9c3462e5d6a0755d3fa69ca11d933aef
      Size/MD5:  2564790 ada35e13122697d5fea9773639654024
      Size/MD5:    15682 b242ac1ce847b1d6d63e8539b41a176a
      Size/MD5:  9135998 b65dfb9ef035cc01c071205c1ec6e5ec
      Size/MD5: 14505730 0ed7b21c70261300999943ca3bcf1816
      Size/MD5:    15526 b535c8f8e4b401fe0bbbf8a8d9d6217b

  armel architecture (ARM Architecture):
      Size/MD5:    16052 e2216cd3d34a0c0e3a26e1043f394576
      Size/MD5: 16686058 ef388115c1a3f3a2c6c9dffd2c81effc
      Size/MD5:    15528 fb3afeddcfa09f079fb898959ac6c3b5

  powerpc architecture (Apple Macintosh G3/G4/G5):
      Size/MD5:    16050 ab495cfe0e2c0fd319eba2b8a3e9ff64
      Size/MD5:  2887434 4a636ec1c5a06cbf729d2213291aa2ee
      Size/MD5: 16064224 3f0f63526a0215877b3c619bbdea0ffe
      Size/MD5:    15528 d930a7237b7efe1d7a7c10d755ab1ded

< Prev   Next >


Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2015 Guardian Digital, Inc. All rights reserved.