Test ID:	1.3.6.1.4.1.25623.1.0.702909
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2909-1)
Summary:	The remote host is missing an update for the Debian 'qemu' package(s) announced via the DSA-2909-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'qemu' package(s) announced via the DSA-2909-1 advisory. Vulnerability Insight: Michael S. Tsirkin of Red Hat discovered a buffer overflow flaw in the way qemu processed MAC addresses table update requests from the guest. A privileged guest user could use this flaw to corrupt qemu process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the qemu process. For the oldstable distribution (squeeze), this problem has been fixed in version 0.12.5+dfsg-3squeeze4. For the stable distribution (wheezy), this problem has been fixed in version 1.1.2+dfsg-6a+deb7u1. For the testing distribution (jessie), this problem has been fixed in version 1.7.0+dfsg-8. For the unstable distribution (sid), this problem has been fixed in version 1.7.0+dfsg-8. We recommend that you upgrade your qemu packages. Affected Software/OS: 'qemu' package(s) on Debian 6, Debian 7. Solution: Please install the updated package(s). CVSS Score: 4.9 CVSS Vector: AV:A/AC:M/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0150 57878 http://secunia.com/advisories/57878 58191 http://secunia.com/advisories/58191 DSA-2909 http://www.debian.org/security/2014/dsa-2909 DSA-2910 http://www.debian.org/security/2014/dsa-2910 USN-2182-1 http://www.ubuntu.com/usn/USN-2182-1 [Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun http://article.gmane.org/gmane.comp.emulators.qemu/266768 [Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun http://thread.gmane.org/gmane.comp.emulators.qemu/266713 https://bugzilla.redhat.com/show_bug.cgi?id=1078846
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.