Debian DSA-2839-1 : spice - denial of service
medium Nessus Plugin ID 71867
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 3.6
Synopsis
The remote Debian host is missing a security-related update.Description
Multiple vulnerabilities have been found in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following issues :- CVE-2013-4130 David Gibson of Red Hat discovered that SPICE incorrectly handled certain network errors. A remote user able to initiate a SPICE connection to an application acting as a SPICE server could use this flaw to crash the application.
- CVE-2013-4282 Tomas Jamrisko of Red Hat discovered that SPICE incorrectly handled long passwords in SPICE tickets. A remote user able to initiate a SPICE connection to an application acting as a SPICE server could use this flaw to crash the application.
Applications acting as a SPICE server must be restarted for this update to take effect.
Solution
Upgrade the spice packages.For the stable distribution (wheezy), these problems have been fixed in version 0.11.0-1+deb7u1.
See Also
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717030
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=728314
https://security-tracker.debian.org/tracker/CVE-2013-4130
https://security-tracker.debian.org/tracker/CVE-2013-4282
Plugin Details
Severity: Medium
ID: 71867
File Name: debian_DSA-2839.nasl
Version: 1.9
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 1/9/2014
Updated: 1/11/2021
Dependencies: ssh_get_info.nasl
Risk Information
Risk Factor: Medium
VPR Score: 3.6
CVSS v2.0
Base Score: 5
Temporal Score: 3.7
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:spice, cpe:/o:debian:debian_linux:7.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 1/8/2014
Reference Information
CVE: CVE-2013-4130, CVE-2013-4282
DSA: 2839