Debian DSA-3284-1 : qemu - security update

high Nessus Plugin ID 84167
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities were discovered in qemu, a fast processor emulator.

- CVE-2015-3209 Matt Tait of Google's Project Zero security team discovered a flaw in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card enabled can potentially use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process.

- CVE-2015-4037 Kurt Seifried of Red Hat Product Security discovered that QEMU's user mode networking stack uses predictable temporary file names when the -smb option is used. An unprivileged user can use this flaw to cause a denial of service.

- CVE-2015-4103 Jan Beulich of SUSE discovered that the QEMU Xen code does not properly restrict write access to the host MSI message data field, allowing a malicious guest to cause a denial of service.

- CVE-2015-4104 Jan Beulich of SUSE discovered that the QEMU Xen code does not properly restrict access to PCI MSI mask bits, allowing a malicious guest to cause a denial of service.

- CVE-2015-4105 Jan Beulich of SUSE reported that the QEMU Xen code enables logging for PCI MSI-X pass-through error messages, allowing a malicious guest to cause a denial of service.

- CVE-2015-4106 Jan Beulich of SUSE discovered that the QEMU Xen code does not properly restrict write access to the PCI config space for certain PCI pass-through devices, allowing a malicious guest to cause a denial of service, obtain sensitive information or potentially execute arbitrary code.

Solution

Upgrade the qemu packages.

For the oldstable distribution (wheezy), these problems have been fixed in version 1.1.2+dfsg-6+deb7u8. Only CVE-2015-3209 and CVE-2015-4037 affect oldstable.

For the stable distribution (jessie), these problems have been fixed in version 1:2.1+dfsg-12+deb8u1.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=787547

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=788460

https://security-tracker.debian.org/tracker/CVE-2015-3209

https://security-tracker.debian.org/tracker/CVE-2015-4037

https://security-tracker.debian.org/tracker/CVE-2015-4103

https://security-tracker.debian.org/tracker/CVE-2015-4104

https://security-tracker.debian.org/tracker/CVE-2015-4105

https://security-tracker.debian.org/tracker/CVE-2015-4106

https://security-tracker.debian.org/tracker/CVE-2015-3209

https://security-tracker.debian.org/tracker/CVE-2015-4037

https://packages.debian.org/source/wheezy/qemu

https://packages.debian.org/source/jessie/qemu

https://www.debian.org/security/2015/dsa-3284

Plugin Details

Severity: High

ID: 84167

File Name: debian_DSA-3284.nasl

Version: 2.7

Type: local

Agent: unix

Published: 6/15/2015

Updated: 1/11/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:qemu, cpe:/o:debian:debian_linux:7.0, cpe:/o:debian:debian_linux:8.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 6/13/2015

Reference Information

CVE: CVE-2015-3209, CVE-2015-4037, CVE-2015-4103, CVE-2015-4104, CVE-2015-4105, CVE-2015-4106

BID: 74809, 74947, 74948, 74949, 74950, 75123

DSA: 3284