QEMU CVE-2014-0145 Multiple Buffer Overflow Vulnerabilities
BID:66464
Info
QEMU CVE-2014-0145 Multiple Buffer Overflow Vulnerabilities
| Bugtraq ID: | 66464 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2014-0145 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 26 2014 12:00AM |
| Updated: | Apr 13 2015 09:18PM |
| Credit: | Stefan Hajnoczi of Red Hat |
| Vulnerable: |
Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server 11 SP3 SuSE Suse Linux Enterprise Desktop 11 SP3 Redhat OpenStack 4.0 Redhat OpenStack 3.0 Redhat Enterprise Virtualization Manager 0 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop 6 QEMU QEMU 0 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 |
| Not Vulnerable: | |
Discussion
QEMU CVE-2014-0145 Multiple Buffer Overflow Vulnerabilities
QEMU is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.
QEMU is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.
Exploit / POC
QEMU CVE-2014-0145 Multiple Buffer Overflow Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
QEMU CVE-2014-0145 Multiple Buffer Overflow Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva lib64usbredirhost-devel-0.7-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64usbredirhost1-0.7-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64usbredirparser-devel-0.7-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64usbredirparser1-0.7-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva qemu-1.6.2-1.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva qemu-img-1.6.2-1.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva usbredir-0.7-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva usbredir-devel-0.7-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/
References
QEMU CVE-2014-0145 Multiple Buffer Overflow Vulnerabilities
References:
References:
- Bug 1078885 - (CVE-2014-0145) CVE-2014-0145 Qemu: prevent possible buffer overfl (Red Hat Bugzilla)
- QEMU Homepage (QEMU)
- QEMU image format input validation fixes (multiple CVEs) (seclists.org)
- ELSA-2014-0420 - qemu-kvm security update (Oracle)