Heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register values to exceed the device memory size, aka "RX Frame heap overflow."

The remote host is affected by the vulnerability described in GLSA-200711-21 (Bochs: Multiple vulnerabilities)

    Tavis Ormandy of the Google Security Team discovered a heap-based     overflow vulnerability in the NE2000 driver (CVE-2007-2893). He also     discovered a divide-by-zero error in the emulated floppy disk     controller (CVE-2007-2894).
  Impact :

    A local attacker in the guest operating system could exploit these     issues to execute code outside of the virtual machine, or cause Bochs     to crash.
  Workaround :

    There is no known workaround at this time.

This security update fixes a bochs buffer overflow which can be triggered by code running inside bochs CVE-2007-2893.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy discovered that bochs, a highly portable IA-32 PC emulator, is vulnerable to a buffer overflow in the emulated NE2000 network device driver, which may lead to privilege escalation.

Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1320     Tavis Ormandy discovered that a memory management     routine of the Cirrus video driver performs insufficient     bounds checking, which might allow the execution of     arbitrary code through a heap overflow.

  - CVE-2007-1321     Tavis Ormandy discovered that the NE2000 network driver     and the socket code perform insufficient input     validation, which might allow the execution of arbitrary     code through a heap overflow.

  - CVE-2007-1322     Tavis Ormandy discovered that the 'icebp' instruction     can be abused to terminate the emulation, resulting in     denial of service.

  - CVE-2007-1323     Tavis Ormandy discovered that the NE2000 network driver     and the socket code perform insufficient input     validation, which might allow the execution of arbitrary     code through a heap overflow.

  - CVE-2007-1366     Tavis Ormandy discovered that the 'aam' instruction can     be abused to crash qemu through a division by zero,     resulting in denial of service.

The Debian Security Team reports :

Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2007-1320Tavis Ormandy discovered that a memory management routine of the Cirrus video driver performs insufficient bounds checking, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1321Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1322Tavis Ormandy discovered that the 'icebp' instruction can be abused to terminate the emulation, resulting in denial of service.

CVE-2007-1323Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1366Tavis Ormandy discovered that the 'aam' instruction can be abused to crash qemu through a division by zero, resulting in denial of service.

ID	Name	Product	Family	Severity
28260	GLSA-200711-21 : Bochs: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
27698	Fedora 7 : bochs-2.3-5.fc7 (2007-1153)	Nessus	Fedora Local Security Checks	high
25859	Debian DSA-1351-1 : bochs - buffer overflow	Nessus	Debian Local Security Checks	high
25151	Debian DSA-1284-1 : qemu - several vulnerabilities	Nessus	Debian Local Security Checks	high
25129	FreeBSD : qemu -- several vulnerabilities (0ac89b39-f829-11db-b55c-000e0c6d38a9)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-2893

high

Tenable Plugins

high

high

high

high

high