National Cyber-Alert System

Vulnerability Summary for CVE-2007-2893

Overview

Heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register values to exceed the device memory size, aka "RX Frame heap overflow."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (11/02/2007)

Not vulnerable. This issue did not affect Xen as shipped with Red Hat Enterprise Linux 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: bochs-ne2000-bo(34508)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34508

External Source: BID

Name: 24246

Hyperlink:http://www.securityfocus.com/bid/24246

External Source: VUPEN

Name: ADV-2007-1936

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2007/1936

External Source: DEBIAN

Name: DSA-1351

Hyperlink:http://www.debian.org/security/2007/dsa-1351

External Source: MISC

Name: http://taviso.decsystem.org/virtsec.pdf

Hyperlink:http://taviso.decsystem.org/virtsec.pdf

External Source: GENTOO

Name: GLSA-200711-21

Hyperlink:http://security.gentoo.org/glsa/glsa-200711-21.xml

External Source: SECUNIA

Name: 27715

Type: Advisory

Hyperlink:http://secunia.com/advisories/27715

External Source: SECUNIA

Name: 26364

Type: Advisory

Hyperlink:http://secunia.com/advisories/26364

External Source: SECUNIA

Name: 25470

Type: Advisory

Hyperlink:http://secunia.com/advisories/25470

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=188148

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=188148