The protocol_client_msg function in vnc.c in the VNC server in (1) Qemu 0.9.1 and earlier and (2) KVM kvm-79 and earlier allows remote attackers to cause a denial of service (infinite loop) via a certain message.

qemu update to version 0.10.1 fixes the following security issues :

CVE-2008-0928: problems with range checks of block devices CVE-2008-1945: problems with removable media handling CVE-2008-2382:
vnc server DoS CVE-2008-4539: fix a heap overflow in the cirrus VGA implementation CVE-2008-5714: off by one error in vnc password handling

Rogue VNC clients could make the built in VNC server of kvm run into an infinite loop (CVE-2008-2382)

An off-by-one bug limited the length of VNC passwords to seven instead of eight (CVE-2008-5714)

Virtualized guests could potentially execute code on the host by triggering a buffer overflow in the network emulation code via large ethernet frames (CVE-2007-5729)

Virtualized guests could potentially execute code on the host by triggering a heap based buffer overflow in the Cirrus Graphics card emulation (CVE-2007-1320).

USN-776-1 fixed vulnerabilities in KVM. Due to an incorrect fix, a regression was introduced in Ubuntu 8.04 LTS that caused KVM to fail to boot virtual machines started via libvirt. This update fixes the problem. We apologize for the inconvenience.

Avi Kivity discovered that KVM did not correctly handle certain disk formats. A local attacker could attach a malicious partition that would allow the guest VM to read files on the VM host. (CVE-2008-1945, CVE-2008-2004)

Alfredo Ortega discovered that KVM's VNC protocol handler did not correctly validate certain messages. A remote attacker could send specially crafted VNC messages that would cause KVM to consume CPU resources, leading to a denial of service. (CVE-2008-2382)

Jan Niehusmann discovered that KVM's Cirrus VGA implementation over VNC did not correctly handle certain bitblt operations. A local attacker could exploit this flaw to potentially execute arbitrary code on the VM host or crash KVM, leading to a denial of service. (CVE-2008-4539)

It was discovered that KVM's VNC password checks did not use the correct length. A remote attacker could exploit this flaw to cause KVM to crash, leading to a denial of service.
(CVE-2008-5714).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Avi Kivity discovered that KVM did not correctly handle certain disk formats. A local attacker could attach a malicious partition that would allow the guest VM to read files on the VM host. (CVE-2008-1945, CVE-2008-2004)

Alfredo Ortega discovered that KVM's VNC protocol handler did not correctly validate certain messages. A remote attacker could send specially crafted VNC messages that would cause KVM to consume CPU resources, leading to a denial of service. (CVE-2008-2382)

Jan Niehusmann discovered that KVM's Cirrus VGA implementation over VNC did not correctly handle certain bitblt operations. A local attacker could exploit this flaw to potentially execute arbitrary code on the VM host or crash KVM, leading to a denial of service.
(CVE-2008-4539)

It was discovered that KVM's VNC password checks did not use the correct length. A remote attacker could exploit this flaw to cause KVM to crash, leading to a denial of service. (CVE-2008-5714).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

----------------------------------------------------------------------
---------- ChangeLog :

  - Mon Dec 22 2008 Glauber Costa <glommer at redhat.com> -     74-10

    - Fixed CVE-2008-2382.

    - Thu Dec 4 2008 Glauber Costa <glommer at redhat.com> -       74-9

    - Fixed bug that corrupted gnome-panel #474703

    - Tue Dec 2 2008 Glauber Costa <glommer at redhat.com> -       74-8

    - Properly set flags for interrupt return #474059

    - Mon Nov 24 2008 Glauber Costa <glommer at redhat.com>
      - 74-7

    - added upstream patch kvm-restore-option-rom.patch -       #470561

    - Tue Nov 11 2008 Glauber Costa <glommer at redhat.com>
      - 74-6

    - Fix cirrus vulnerability (CVE-2008-4539) - #471055

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paul Szabo discovered that the DECRQSS escape sequences were not handled correctly by xterm. Additionally, window title operations were also not safely handled. If a user were tricked into viewing a specially crafted series of characters while in xterm, a remote attacker could execute arbitrary commands with user privileges.
(CVE-2006-7236, CVE-2008-2382).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security vulnerability have been discovered and corrected in VNC server of qemu 0.9.1 and earlier, which could lead to a denial-of-service attack (CVE-2008-2382).

The updated packages have been patched to prevent this.

Security vulnerabilities have been discovered and corrected in VNC server of qemu version 0.9.1 and earlier, which could lead to denial-of-service attacks (CVE-2008-2382), and make it easier for remote crackers to guess the VNC password (CVE-2008-5714).

The updated packages have been patched to prevent this.

Security vulnerabilities have been discovered and corrected in VNC server of kvm version 79 and earlier, which could lead to denial-of-service attacks (CVE-2008-2382), and make it easier for remote crackers to guess the VNC password (CVE-2008-5714).

The updated packages have been patched to prevent this.

----------------------------------------------------------------------
---------- ChangeLog :

  - Mon Dec 22 2008 Glauber Costa <gcosta at redhat.com> -     65-15.fc9

    - Fixed CVE-2008-2382.

    - Thu Dec 4 2008 Glauber Costa <gcosta at redhat.com> -       65-14.fc9

    - Fixed bug that corrupted gnome-panel #474702

    - Tue Dec 2 2008 Glauber Costa <gcosta at redhat.com> -       65-12.fc9

    - Properly set flags for interrupt return #464304

    - Tue Nov 11 2008 Glauber Costa <gcosta at redhat.com> -       65-11.fc9

    - Fix CVE-2008-4539 #448525

    - Mon Oct 13 2008 Glauber Costa <gcosta at redhat.com> -       65-10.fc9

    - Fix sysenter save in 64-bit hosts #457649

    - Thu Aug 28 2008 Glauber Costa <gcosta at redhat.com> -       65-9.fc9

    - there's already a 65-8 tag

    - Thu Aug 28 2008 Glauber Costa <gcosta at redhat.com> -       65-8.fc9

    - Fixes #459778

    - Fixes #452355

    - Tue May 27 2008 Glauber Costa <gcosta at redhat.com> -       65-7.fc9

    - Fix the build

    - Tue May 27 2008 Glauber Costa <gcosta at redhat.com> -       65-6.fc9

    - Fix Cirrus heap overflow vulnerability (#448525)

    - Fri May 23 2008 Daniel P. Berrange <berrange at       redhat.com> - 65-5.fc9

    - Put PTY in rawmode

    - Tue May 20 2008 Mark McLoughlin <markmc at redhat.com>
      - 65-4.fc9

    - Re-enable patch to fix -kernel with virtio/extboot       drives (#444578)

    - Fri May 16 2008 Glauber Costa <gcosta at redhat.com> -       65-3.fc9

    - Fix problem with cirrus device that was breaking vnc       connections (rhbz #446830)

    - Tue Apr 29 2008 Mark McLoughlin <markmc at redhat.com>
      - 65-2

    - Fix -kernel with virtio/extboot drives (#444578)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
40302	openSUSE Security Update : qemu (qemu-691)	Nessus	SuSE Local Security Checks	high
40254	openSUSE Security Update : kvm (kvm-412)	Nessus	SuSE Local Security Checks	high
40118	openSUSE Security Update : qemu (qemu-691)	Nessus	SuSE Local Security Checks	high
40019	openSUSE Security Update : kvm (kvm-412)	Nessus	SuSE Local Security Checks	high
38777	Ubuntu 8.04 LTS : kvm regression (USN-776-2)	Nessus	Ubuntu Local Security Checks	high
38759	Ubuntu 8.04 LTS / 8.10 : kvm vulnerabilities (USN-776-1)	Nessus	Ubuntu Local Security Checks	high
37268	Fedora 10 : kvm-74-10.fc10 (2008-11727)	Nessus	Fedora Local Security Checks	medium
37162	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : xterm vulnerabilities (USN-703-1)	Nessus	Ubuntu Local Security Checks	high
37093	Mandriva Linux Security Advisory : qemu (MDVSA-2009:010)	Nessus	Mandriva Local Security Checks	medium
36993	Mandriva Linux Security Advisory : qemu (MDVSA-2009:008)	Nessus	Mandriva Local Security Checks	high
36990	Mandriva Linux Security Advisory : kvm (MDVSA-2009:009)	Nessus	Mandriva Local Security Checks	high
36082	openSUSE 10 Security Update : qemu (qemu-6123)	Nessus	SuSE Local Security Checks	high
35266	Fedora 9 : kvm-65-15.fc9 (2008-11705)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-2382

high

Tenable Plugins

high

high

high

high

high

high

medium

high

medium

high

high

high

high