LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: July 28th, 2014
Linux Advisory Watch: July 25th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: 2013:121: qemu Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake Updated qemu packages fix security vulnerability: A flaw was found in how qemu, in snapshot mode (-snapshot command line argument), handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only [More...]
 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2013:121
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : qemu
 Date    : April 10, 2013
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated qemu packages fix security vulnerability:
 
 A flaw was found in how qemu, in snapshot mode (-snapshot command
 line argument), handled the creation and opening of the temporary
 file used to store the difference of the virtualized guest's read-only
 image and the current state. In snapshot mode, bdrv_open() creates an
 empty temporary file without checking for any mkstemp() or close()
 failures; it also ignores the possibility of a buffer overrun
 given an exceptionally long /tmp. Because qemu re-opens that file
 after creation, it is possible to race qemu and insert a symbolic
 link with the same expected name as the temporary file, pointing
 to an attacker-chosen file. This can be used to either overwrite
 the destination file with the privileges of the user running qemu
 (typically root), or to point to an attacker-readable file that could
 expose data from the guest to the attacker (CVE-2012-2652).
 
 A flaw was found in the way QEMU handled VT100 terminal escape
 sequences when emulating certain character devices. A guest user
 with privileges to write to a character device that is emulated on
 the host using a virtual console back-end could use this flaw to
 crash the qemu-kvm process on the host or, possibly, escalate their
 privileges on the host (CVE-2012-3515).
 
 It was discovered that the e1000 emulation code in QEMU does not
 enforce frame size limits in the same way as the real hardware
 does. This could trigger buffer overflows in the guest operating system
 driver for that network card, assuming that the host system does not
 discard such frames (which it will by default) (CVE-2012-6075).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6075
 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0185
 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0263
 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0025
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 2077322ff415a0f63921650be5b4d7fa  mbs1/x86_64/qemu-1.0-8.1.mbs1.x86_64.rpm
 a4741d08a3dedd1007296ac535ecce83  mbs1/x86_64/qemu-img-1.0-8.1.mbs1.x86_64.rpm 
 4e9cead8b0e57eec5c5e36abf0318efa  mbs1/SRPMS/qemu-1.0-8.1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Hackers Plundered Israeli Defense Firms that Built ‘Iron Dome’ Missile Defense System
Internet of things big security worry, says HP
Boffins build FREE SUPERCOMPUTER from free cloud server trials
Insecure Connections: Enterprises hacked after neglecting third-party risks
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.