SuSE 11.3 Security Update : kvm (SAT Patch Number 9739)

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote SuSE 11 host is missing a security update.

Description :

kvm has been updated to fix issues in the embedded qemu :

- An integer overflow flaw was found in the QEMU block
driver for QCOW version 1 disk images. A user able to
alter the QEMU disk image files loaded by a guest could
have used this flaw to corrupt QEMU process memory on
the host, which could potentially have resulted in
arbitrary code execution on the host with the privileges
of the QEMU process. (CVE-2014-0223)

- A user able to alter the savevm data (either on the disk
or over the wire during migration) could have used this
flaw to to corrupt QEMU process memory on the
(destination) host, which could have potentially
resulted in arbitrary code execution on the host with
the privileges of the QEMU process. (CVE-2014-3461)

- An integer overflow flaw was found in the QEMU block
driver for QCOW version 1 disk images. A user able to
alter the QEMU disk image files loaded by a guest could
have used this flaw to corrupt QEMU process memory on
the host, which could have potentially resulted in
arbitrary code execution on the host with the privileges
of the QEMU process. (CVE-2014-0222)

Non-security bugs fixed :

- Fix exceeding IRQ routes that could have caused freezes
of guests. (bnc#876842)

- Fix CPUID emulation bugs that may have broken Windows
guests with newer -cpu types (bnc#886535)

See also :

https://bugzilla.novell.com/show_bug.cgi?id=876842
https://bugzilla.novell.com/show_bug.cgi?id=877642
https://bugzilla.novell.com/show_bug.cgi?id=877645
https://bugzilla.novell.com/show_bug.cgi?id=878541
https://bugzilla.novell.com/show_bug.cgi?id=886535
http://support.novell.com/security/cve/CVE-2014-0222.html
http://support.novell.com/security/cve/CVE-2014-0223.html
http://support.novell.com/security/cve/CVE-2014-3461.html

Solution :

Apply SAT patch number 9739.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: SuSE Local Security Checks

Nessus Plugin ID: 78105 ()

Bugtraq ID:

CVE ID: CVE-2014-0222
CVE-2014-0223
CVE-2014-3461

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now