Red Hat SPICE Plugin for Microsoft Internet Explorer Race Condition Vulnerability

Bugtraq ID:	45213
Class:	Race Condition Error
CVE:	CVE-2010-2793
Remote:	No
Local:	Yes
Published:	Dec 06 2010 12:00AM
Updated:	Jan 05 2011 05:42PM
Credit:	Reported by Red Hat
Vulnerable:	Red Hat Enterprise Virtualization Manager 2.2.3 Red Hat Enterprise Virtualization Manager 2.2.2 Red Hat Enterprise Virtualization Manager 2.2
Not Vulnerable:	Red Hat Enterprise Virtualization Manager 2.2.4

Red Hat SPICE Plugin for Microsoft Internet Explorer Race Condition Vulnerability

SPICE (Simple Protocol for Independent Computing Environments) is prone to a race-condition vulnerability.

A local attacker can exploit this issue to gain access to authentication details or perform a man-in-the-middle attack on the SPICE connection. Other attacks may be possible.

Red Hat SPICE Plugin for Microsoft Internet Explorer Race Condition Vulnerability

Attackers can use standard commands to exploit this issue.

Red Hat SPICE Plugin for Microsoft Internet Explorer Race Condition Vulnerability

Solution:
Updates are available. Please see the references for more information.

Red Hat SPICE Plugin for Microsoft Internet Explorer Race Condition Vulnerability

References:

• Red Hat Homepage (Red Hat)