Test ID:	1.3.6.1.4.1.25623.1.0.841701
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2092-1)
Summary:	The remote host is missing an update for the 'qemu, qemu-kvm' package(s) announced via the USN-2092-1 advisory.
Description:	Summary: The remote host is missing an update for the 'qemu, qemu-kvm' package(s) announced via the USN-2092-1 advisory. Vulnerability Insight: Asias He discovered that QEMU incorrectly handled SCSI controllers with more than 256 attached devices. A local user could possibly use this flaw to elevate privileges. (CVE-2013-4344) It was discovered that QEMU incorrectly handled Xen disks. A local guest could possibly use this flaw to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.10 and Ubuntu 13.10. (CVE-2013-4375) Sibiao Luo discovered that QEMU incorrectly handled device hot-unplugging. A local user could possibly use this flaw to cause a denial of service. This issue only affected Ubuntu 13.10. (CVE-2013-4377) Affected Software/OS: 'qemu, qemu-kvm' package(s) on Ubuntu 12.04, Ubuntu 12.10, Ubuntu 13.10. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-4344 62773 http://www.securityfocus.com/bid/62773 98028 http://osvdb.org/98028 RHSA-2013:1553 http://rhn.redhat.com/errata/RHSA-2013-1553.html RHSA-2013:1754 http://rhn.redhat.com/errata/RHSA-2013-1754.html USN-2092-1 http://www.ubuntu.com/usn/USN-2092-1 [oss-security] 20131002 Xen Security Advisory 65 (CVE-2013-4344) - qemu SCSI REPORT LUNS buffer overflow http://www.openwall.com/lists/oss-security/2013/10/02/2 [qemu-devel] 20131009 [ANNOUNCE] QEMU 1.6.1 Stable released http://article.gmane.org/gmane.comp.emulators.qemu/237191 openSUSE-SU-2014:1279 http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html openSUSE-SU-2014:1281 http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html Common Vulnerability Exposure (CVE) ID: CVE-2013-4375 GLSA-201407-03 http://security.gentoo.org/glsa/glsa-201407-03.xml [oss-security] 20131010 Xen Security Advisory 71 (CVE-2013-4375) - qemu disk backend (qdisk) resource leak http://www.openwall.com/lists/oss-security/2013/10/10/14 http://xenproject.org/downloads/xen-archives/supported-xen-43-series/xen-431.html Common Vulnerability Exposure (CVE) ID: CVE-2013-4377 55015 http://secunia.com/advisories/55015 [Qemu-devel] 20130920 [PATCH 11/11] virtio-pci: add device_unplugged callback http://lists.nongnu.org/archive/html/qemu-devel/2013-09/msg03347.html [oss-security] 20130926 Re: CVE request: qemu host crash from within guest http://www.openwall.com/lists/oss-security/2013/09/26/5 https://bugzilla.redhat.com/show_bug.cgi?id=1012633
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.