Test ID:	1.3.6.1.4.1.25623.1.0.703285
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3285-1)
Summary:	The remote host is missing an update for the Debian 'qemu-kvm' package(s) announced via the DSA-3285-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'qemu-kvm' package(s) announced via the DSA-3285-1 advisory. Vulnerability Insight: Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-3209 Matt Tait of Google's Project Zero security team discovered a flaw in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card enabled can potentially use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process. CVE-2015-4037 Kurt Seifried of Red Hat Product Security discovered that QEMU's user mode networking stack uses predictable temporary file names when the -smb option is used. An unprivileged user can use this flaw to cause a denial of service. For the oldstable distribution (wheezy), these problems have been fixed in version 1.1.2+dfsg-6+deb7u8. We recommend that you upgrade your qemu-kvm packages. Affected Software/OS: 'qemu-kvm' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3209 1032545 http://www.securitytracker.com/id/1032545 75123 http://www.securityfocus.com/bid/75123 DSA-3284 http://www.debian.org/security/2015/dsa-3284 DSA-3285 http://www.debian.org/security/2015/dsa-3285 DSA-3286 http://www.debian.org/security/2015/dsa-3286 FEDORA-2015-10001 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160669.html FEDORA-2015-9965 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html FEDORA-2015-9978 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160677.html GLSA-201510-02 https://security.gentoo.org/glsa/201510-02 GLSA-201604-03 https://security.gentoo.org/glsa/201604-03 RHSA-2015:1087 http://rhn.redhat.com/errata/RHSA-2015-1087.html RHSA-2015:1088 http://rhn.redhat.com/errata/RHSA-2015-1088.html RHSA-2015:1089 http://rhn.redhat.com/errata/RHSA-2015-1089.html RHSA-2015:1189 http://rhn.redhat.com/errata/RHSA-2015-1189.html SUSE-SU-2015:1042 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html SUSE-SU-2015:1045 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html SUSE-SU-2015:1152 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00027.html SUSE-SU-2015:1156 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html SUSE-SU-2015:1157 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html SUSE-SU-2015:1206 http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.html SUSE-SU-2015:1426 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.html SUSE-SU-2015:1519 http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00015.html SUSE-SU-2015:1643 http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.html USN-2630-1 http://www.ubuntu.com/usn/USN-2630-1 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 http://xenbits.xen.org/xsa/advisory-135.html https://kb.juniper.net/JSA10783 https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13 Common Vulnerability Exposure (CVE) ID: CVE-2015-4037 1032547 http://www.securitytracker.com/id/1032547 74809 http://www.securityfocus.com/bid/74809 FEDORA-2015-9599 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160414.html FEDORA-2015-9601 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160058.html [oss-security] 20150513 QEMU 2.3.0 tmp vulns CVE request http://www.openwall.com/lists/oss-security/2015/05/13/7 [oss-security] 20150516 Re: QEMU 2.3.0 tmp vulns CVE request http://www.openwall.com/lists/oss-security/2015/05/16/5 [oss-security] 20150523 Re: QEMU 2.3.0 tmp vulns CVE request http://www.openwall.com/lists/oss-security/2015/05/23/4 https://bugzilla.redhat.com/show_bug.cgi?id=1222892 openSUSE-SU-2015:1965 http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.