Test ID:	1.3.6.1.4.1.25623.1.0.882305
Category:	CentOS Local Security Checks
Title:	CentOS Update for qemu-guest-agent CESA-2015:1924 centos6
Summary:	Check the version of qemu-guest-agent
Description:	Summary: Check the version of qemu-guest-agent Vulnerability Insight: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host. (CVE-2015-5279) Red Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. Affected Software/OS: qemu-guest-agent on CentOS 6 Solution: Please install the updated packages. CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-5279 1033569 http://www.securitytracker.com/id/1033569 76746 http://www.securityfocus.com/bid/76746 DSA-3361 http://www.debian.org/security/2015/dsa-3361 DSA-3362 http://www.debian.org/security/2015/dsa-3362 FEDORA-2015-16368 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169039.html FEDORA-2015-16369 http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169036.html FEDORA-2015-16370 http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167369.html GLSA-201602-01 https://security.gentoo.org/glsa/201602-01 RHSA-2015:1896 http://rhn.redhat.com/errata/RHSA-2015-1896.html RHSA-2015:1923 http://rhn.redhat.com/errata/RHSA-2015-1923.html RHSA-2015:1924 http://rhn.redhat.com/errata/RHSA-2015-1924.html RHSA-2015:1925 http://rhn.redhat.com/errata/RHSA-2015-1925.html SUSE-SU-2015:1782 http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html [Qemu-devel] 20150915 [PULL 2/3] net: add checks to validate ring buffer pointers https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html [oss-security] 20150915 CVE-2015-5279 Qemu: net: add checks to validate ring buffer pointers http://www.openwall.com/lists/oss-security/2015/09/15/3 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html https://www.arista.com/en/support/advisories-notices/security-advisories/1188-security-advisory-14
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.