RHEL 6 : rhev-hypervisor6 (RHSA-2015:0126) (GHOST)

This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated rhev-hypervisor6 package that fixes multiple security
issues is now available for Red Hat Enterprise Virtualization 3.

Red Hat Product Security has rated this update as having Critical
security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

The rhev-hypervisor6 package provides a Red Hat Enterprise
Virtualization Hypervisor ISO disk image. The Red Hat Enterprise
Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine
(KVM) hypervisor. It includes everything necessary to run and manage
virtual machines: a subset of the Red Hat Enterprise Linux operating
environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available
for the Intel 64 and AMD64 architectures with virtualization
extensions.

A heap-based buffer overflow was found in glibc's
__nss_hostname_digits_dots() function, which is used by the
gethostbyname() and gethostbyname2() glibc function calls. A remote
attacker able to make an application call either of these functions
could use this flaw to execute arbitrary code with the permissions of
the user running the application. (CVE-2015-0235)

A race condition flaw was found in the way the Linux kernel's KVM
subsystem handled PIT (Programmable Interval Timer) emulation. A guest
user who has access to the PIT I/O ports could use this flaw to crash
the host. (CVE-2014-3611)

A flaw was found in the way OpenSSL handled fragmented handshake
packets. A man-in-the-middle attacker could use this flaw to force a
TLS/SSL server using OpenSSL to use TLS 1.0, even if both the client
and the server supported newer protocol versions. (CVE-2014-3511)

A memory leak flaw was found in the way an OpenSSL handled failed
session ticket integrity checks. A remote attacker could exhaust all
available memory of an SSL/TLS or DTLS server by sending a large
number of invalid session tickets to that server. (CVE-2014-3567)

It was found that the Linux kernel's KVM subsystem did not handle the
VM exits gracefully for the invept (Invalidate Translations Derived
from EPT) and invvpid (Invalidate Translations Based on VPID)
instructions. On hosts with an Intel processor and invept/invppid VM
exit support, an unprivileged guest user could use these instructions
to crash the guest. (CVE-2014-3645, CVE-2014-3646)

Red Hat would like to thank Qualys for reporting the CVE-2015-0235
issue, Lars Bull of Google for reporting the CVE-2014-3611 issue, and
the Advanced Threat Research team at Intel Security for reporting the
CVE-2014-3645 and CVE-2014-3646 issues.

Users of the Red Hat Enterprise Virtualization Hypervisor are advised
to upgrade to this updated package.

See also :

https://www.redhat.com/security/data/cve/CVE-2014-3511.html
https://www.redhat.com/security/data/cve/CVE-2014-3567.html
https://www.redhat.com/security/data/cve/CVE-2014-3611.html
https://www.redhat.com/security/data/cve/CVE-2014-3645.html
https://www.redhat.com/security/data/cve/CVE-2014-3646.html
https://www.redhat.com/security/data/cve/CVE-2015-0235.html
http://rhn.redhat.com/errata/RHSA-2015-0126.html

Solution :

Update the affected rhev-hypervisor6 package.

Risk factor :

High / CVSS Base Score : 7.6
(CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.3
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 81200 ()

Bugtraq ID: 70743
70745
70746

CVE ID: CVE-2014-3511
CVE-2014-3567
CVE-2014-3611
CVE-2014-3645
CVE-2014-3646
CVE-2015-0235

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now