exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Ubuntu Security Notice USN-2692-1

Ubuntu Security Notice USN-2692-1
Posted Jul 29, 2015
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2692-1 - Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a non-default configuration, a malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. Kevin Wolf discovered that QEMU incorrectly handled processing ATAPI commands. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2015-3214, CVE-2015-5154, CVE-2015-5158
SHA-256 | 3ce14f5f91a3957a62189bc98416489ca3815723c67a8c178b27bc6f07b581b9

Ubuntu Security Notice USN-2692-1

Change Mirror Download
============================================================================
Ubuntu Security Notice USN-2692-1
July 28, 2015

qemu vulnerabilities
============================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 15.04
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in QEMU.

Software Description:
- qemu: Machine emulator and virtualizer

Details:

Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a
non-default configuration, a malicious guest could use this issue to cause
a denial of service, or possibly execute arbitrary code on the host as the
user running the QEMU process. In the default installation, when QEMU is
used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. (CVE-2015-3214)

Kevin Wolf discovered that QEMU incorrectly handled processing ATAPI
commands. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by the libvirt AppArmor profile.
(CVE-2015-5154)

Zhu Donghai discovered that QEMU incorrectly handled the SCSI driver. A
malicious guest could use this issue to cause a denial of service, or
possibly execute arbitrary code on the host as the user running the QEMU
process. In the default installation, when QEMU is used with libvirt,
attackers would be isolated by the libvirt AppArmor profile. This issue
only affected Ubuntu 15.04. (CVE-2015-5158)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
qemu-system 1:2.2+dfsg-5expubuntu9.3
qemu-system-aarch64 1:2.2+dfsg-5expubuntu9.3
qemu-system-arm 1:2.2+dfsg-5expubuntu9.3
qemu-system-mips 1:2.2+dfsg-5expubuntu9.3
qemu-system-misc 1:2.2+dfsg-5expubuntu9.3
qemu-system-ppc 1:2.2+dfsg-5expubuntu9.3
qemu-system-sparc 1:2.2+dfsg-5expubuntu9.3
qemu-system-x86 1:2.2+dfsg-5expubuntu9.3

Ubuntu 14.04 LTS:
qemu-system 2.0.0+dfsg-2ubuntu1.15
qemu-system-aarch64 2.0.0+dfsg-2ubuntu1.15
qemu-system-arm 2.0.0+dfsg-2ubuntu1.15
qemu-system-mips 2.0.0+dfsg-2ubuntu1.15
qemu-system-misc 2.0.0+dfsg-2ubuntu1.15
qemu-system-ppc 2.0.0+dfsg-2ubuntu1.15
qemu-system-sparc 2.0.0+dfsg-2ubuntu1.15
qemu-system-x86 2.0.0+dfsg-2ubuntu1.15

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2692-1
CVE-2015-3214, CVE-2015-5154, CVE-2015-5158

Package Information:
https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.3
https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.15
Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close