QEMU and KVM VNC Server Remote Denial of Service Vulnerability

Bugtraq ID:	32910
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-2382
Remote:	Yes
Local:	No
Published:	Dec 22 2008 12:00AM
Updated:	May 07 2015 05:03PM
Credit:	Alfredo Ortega from Core Security Technologies
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 SuSE SUSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 10 SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Qumranet KVM 79 Qumranet KVM 36 QEMU QEMU 0.9.1 QEMU QEMU 0.9 QEMU QEMU 0.8.2 QEMU QEMU 0.6.1 Pardus Linux 2008 0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0
Not Vulnerable:

QEMU and KVM VNC Server Remote Denial of Service Vulnerability

QEMU and KVM are prone to a remote denial-of-service vulnerability that affects the included VNC server.

Attackers can exploit this issue to create a denial-of-service condition.

The following are vulnerable:

QEMU 0.9.1 and prior
KVM-79 and prior

QEMU and KVM VNC Server Remote Denial of Service Vulnerability

The following example exploit is available:

• /data/vulnerabilities/exploits/32910.py

QEMU and KVM VNC Server Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu kvm-source_72+dfsg-1ubuntu6.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_72+df sg-1ubuntu6.1_all.deb

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva dkms-kqemu-1.3.0-0.pre11.15.3mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-0.9.0-18.3mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-img-0.9.0-18.3mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1

• Mandriva dkms-kqemu-1.3.0-0.pre11.15.3mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-0.9.0-18.3mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-img-0.9.0-18.3mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu kvm-source_72+dfsg-1ubuntu6.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_72+df sg-1ubuntu6.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu kvm-source_62+dfsg-0ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.1_all.deb


• Ubuntu kvm-source_62+dfsg-0ubuntu8.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.2_all.deb

Mandriva Linux Mandrake 2009.0

• Mandriva dkms-kqemu-1.4.0-0.pre1.0.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva kvm-74-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-0.9.1-0.r5137.1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-img-0.9.1-0.r5137.1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu kvm-source_72+dfsg-1ubuntu6.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_72+df sg-1ubuntu6.1_all.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu kvm-source_72+dfsg-1ubuntu6.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_72+df sg-1ubuntu6.1_all.deb


• Ubuntu kvm_72+dfsg-1ubuntu6.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/k/kvm/kvm_72+dfsg-1ubuntu6 .1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu kvm-source_62+dfsg-0ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.1_all.deb


• Ubuntu kvm-source_62+dfsg-0ubuntu8.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu kvm-source_62+dfsg-0ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.1_all.deb


• Ubuntu kvm-source_62+dfsg-0ubuntu8.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.2_all.deb


• Ubuntu kvm_62+dfsg-0ubuntu8.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/k/kvm/kvm_62+dfsg-0ubuntu8 .1_i386.deb


• Ubuntu kvm_62+dfsg-0ubuntu8.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/k/kvm/kvm_62+dfsg-0ubuntu8 .2_i386.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva dkms-kqemu-1.4.0-0.pre1.0.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva kvm-74-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-0.9.1-0.r5137.1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-img-0.9.1-0.r5137.1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva dkms-kqemu-1.3.0-0.pre11.13.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-0.9.0-16.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-img-0.9.0-16.3mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu kvm-source_62+dfsg-0ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.1_all.deb


• Ubuntu kvm-source_62+dfsg-0ubuntu8.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.2_all.deb


• Ubuntu kvm_62+dfsg-0ubuntu8.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/k/kvm/kvm_62+dfsg-0ubuntu8 .1_amd64.deb


• Ubuntu kvm_62+dfsg-0ubuntu8.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/k/kvm/kvm_62+dfsg-0ubuntu8 .2_amd64.deb

Mandriva Linux Mandrake 2008.0

• Mandriva dkms-kqemu-1.3.0-0.pre11.13.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-0.9.0-16.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva qemu-img-0.9.0-16.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu kvm-source_72+dfsg-1ubuntu6.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_72+df sg-1ubuntu6.1_all.deb


• Ubuntu kvm_72+dfsg-1ubuntu6.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/k/kvm/kvm_72+dfsg-1ubuntu6 .1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu kvm-source_62+dfsg-0ubuntu8.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.1_all.deb


• Ubuntu kvm-source_62+dfsg-0ubuntu8.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/k/kvm/kvm-source_62+df sg-0ubuntu8.2_all.deb

QEMU and KVM VNC Server Remote Denial of Service Vulnerability

References:

• KVM Homepage (Qumranet)
  
• Qemu and KVM VNC server remote DoS (Core Security Technologies)
  
• QEMU Homepage (QEMU)
  
• CORE-2008-1210: Qemu and KVM VNC server remote DoS (CORE Security Technologies Advisories )