QEMU CVE-2015-1779 Denial of Service Vulnerability
BID:73303
Info
QEMU CVE-2015-1779 Denial of Service Vulnerability
| Bugtraq ID: | 73303 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2015-1779 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 24 2015 12:00AM |
| Updated: | Oct 26 2016 03:00AM |
| Credit: | Daniel P. Berrange of Red Hat |
| Vulnerable: |
Ubuntu Ubuntu Linux 15.04 Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 SuSE SUSE Linux Enterprise Server 11 SP3 SuSE Linux Enterprise Server 12 SuSE Linux Enterprise Desktop 12 SuSE Linux Enterprise Desktop 11 SP3 S.u.S.E. openSUSE 13.2 Redhat Enterprise Virtualization Hypervisor 7 Redhat Enterprise Linux Workstation 7 Redhat Enterprise Linux Server 7 Redhat Enterprise Linux HPC Node 7 Redhat Enterprise Linux Desktop 7 QEMU QEMU 2.0 QEMU QEMU 1.7.1 QEMU QEMU 2.1.2 QEMU QEMU 2.1.1 QEMU QEMU 2.1.0 QEMU QEMU 2.0.2 QEMU QEMU 1.6.2 QEMU QEMU 1.6.1 QEMU QEMU 1.6.0 QEMU QEMU 1.5.3 QEMU QEMU 1.5.2 QEMU QEMU 1.4.2 QEMU QEMU 1.4.1 QEMU QEMU 1.4.0 Oracle Linux 0 Oracle Enterprise Linux 7 IBM PowerKVM 2.1.1 SP3 IBM PowerKVM 2.1.1 Build 65.7 IBM PowerKVM 2.1.1 Build 65.6 IBM PowerKVM 2.1.1 Build 65.5 IBM PowerKVM 2.1.1 Build 65.4 IBM PowerKVM 2.1.1 build 57 IBM PowerKVM 3.1.0.2 IBM PowerKVM 3.1 SP2 IBM PowerKVM 3.1 SP1 IBM PowerKVM 3.1 Build 3 IBM PowerKVM 3.1 Build 2 IBM PowerKVM 3.1 IBM PowerKVM 2.1.1.3-65.10 IBM PowerKVM 2.1.1.3-65 IBM PowerKVM 2.1.1 SP2 (build 51) IBM PowerKVM 2.1.1 Build 65.1 IBM PowerKVM 2.1.1 build 58 IBM PowerKVM 2.1 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 7 |
| Not Vulnerable: |
IBM PowerKVM 3.1.0.2 Update 1 IBM PowerKVM 2.1.1.3-65.11 |
Discussion
QEMU CVE-2015-1779 Denial of Service Vulnerability
QEMU is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to exhaust memory and CPU resources, resulting in a denial-of-service condition.
QEMU is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to exhaust memory and CPU resources, resulting in a denial-of-service condition.
Exploit / POC
QEMU CVE-2015-1779 Denial of Service Vulnerability
An attacker can exploit this issue by using readily available utilities.
An attacker can exploit this issue by using readily available utilities.
Solution / Fix
QEMU CVE-2015-1779 Denial of Service Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
QEMU CVE-2015-1779 Denial of Service Vulnerability
References:
References:
- CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decode (Red Hat Bugzilla)
- QEMU Homepage (QEMU)
- Re: [Qemu-devel] [PATCH 1/2] CVE-2015-1779: incrementally decode websock (GNU)
- [Qemu-devel] [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC web (GNU)
- isg3T1024322: Multiple vulnerabilities in qemu affect PowerKVM (IBM)
- PowerKVM is affected by a Qemu vulnerability (CVE-2015-1779) (IBM)
- Ref: linuxbulletinoct2015-2719645 Oracle Linux Bulletin - October 2015 Revision (Oracle)
- RHSA-2015:1931-1 Moderate: qemu-kvm-rhev security update (Red Hat)
- RHSA-2015:1943-1 Moderate: qemu-kvm security update (Red Hat)