RHEL 6 : rhev-hypervisor6 (RHSA-2014:0629)

This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated rhev-hypervisor6 package that fixes two security issues is
now available.

The Red Hat Security Response Team has rated this update as having
Important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for
each vulnerability from the CVE links in the References section.

The rhev-hypervisor6 package provides a Red Hat Enterprise
Virtualization Hypervisor ISO disk image. The Red Hat Enterprise
Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine
(KVM) hypervisor. It includes everything necessary to run and manage
virtual machines: a subset of the Red Hat Enterprise Linux operating
environment and the Red Hat Enterprise Virtualization Agent.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL
v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

Note: Red Hat Enterprise Virtualization Hypervisor is only available
for the Intel 64 and AMD64 architectures with virtualization
extensions.

It was found that OpenSSL clients and servers could be forced, via a
specially crafted handshake packet, to use weak keying material for
communication. A man-in-the-middle attacker could use this flaw to
decrypt and modify traffic between a client and a server.
(CVE-2014-0224)

Note: In order to exploit this flaw, both the server and the client
must be using a vulnerable version of OpenSSL; the server must be
using OpenSSL version 1.0.1 and above, and the client must be using
any version of OpenSSL. For more information about this flaw, refer
to: https://access.redhat.com/site/articles/904433

A flaw was found in the way the handle_rx() function handled large
network packets when mergeable buffers were disabled. A privileged
guest user could use this flaw to crash the host or corrupt QEMU
process memory on the host, which could potentially result in
arbitrary code execution on the host with the privileges of the QEMU
process. (CVE-2014-0077)

Red Hat would like to thank the OpenSSL project for reporting
CVE-2014-0224. Upstream acknowledges KIKUCHI Masashi of Lepidum as the
original reporter of CVE-2014-0224. The CVE-2014-0077 issue was
discovered by Michael S. Tsirkin of Red Hat.

This updated package provides updated components that include fixes
for various security issues. These issues have no security impact on
Red Hat Enterprise Virtualization Hypervisor itself, however. The
security fixes included in this update address the following CVE
numbers :

CVE-2014-0015 and CVE-2014-0138 (curl issues)

CVE-2014-2523 and CVE-2013-6383 (kernel issues)

CVE-2014-0179 (libvirt issue)

CVE-2010-5298, CVE-2014-0198, CVE-2014-0221, CVE-2014-0195, and
CVE-2014-3470 (openssl issues)

Users of the Red Hat Enterprise Virtualization Hypervisor are advised
to upgrade to this updated package, which corrects these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2014-0077.html
https://www.redhat.com/security/data/cve/CVE-2014-0224.html
https://access.redhat.com/site/articles/904433
https://access.redhat.com/site/solutions/906913
https://access.redhat.com/site/documentation/en-US/
http://rhn.redhat.com/errata/RHSA-2014-0629.html

Solution :

Update the affected rhev-hypervisor6 package.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.9
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 79027 ()

Bugtraq ID: 67899

CVE ID: CVE-2014-0077
CVE-2014-0224

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now