National Vulnerability Database (NVD) National Vulnerability Database (CVE-2008-4539)

National Cyber-Alert System

Vulnerability Summary for CVE-2008-4539

Original release date:12/29/2008

Last revised:05/16/2009

Source: US-CERT/NIST

Overview

Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:7.2 (HIGH) (AV:L/AC:L/Au:N/C:C/I:C/A:C) (legend)

Impact Subscore: 10.0

Exploitability Subscore: 3.9

CVSS Version 2 Metrics:

Access Vector: Locally exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-11705

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01223.html

External Source: CONFIRM

Name: https://launchpad.net/ubuntu/jaunty/+source/qemu/0.9.1+svn20081112-1ubuntu1

Hyperlink:https://launchpad.net/ubuntu/jaunty/+source/qemu/0.9.1+svn20081112-1ubuntu1

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=466890

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=466890

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=448525

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=448525

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=237342

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=237342

External Source: XF

Name: qemu-kvm-cirrusvga-bo(47736)

Hyperlink:http://xforce.iss.net/xforce/xfdb/47736

External Source: UBUNTU

Name: USN-776-1

Hyperlink:http://www.ubuntu.com/usn/usn-776-1

External Source: MLIST

Name: [secure-testing-commits] 20081103 r10251 - data/CVE

Hyperlink:http://www.mail-archive.com/secure-testing-commits@lists.alioth.debian.org/msg09322.html

External Source: MLIST

Name: [cvs-all] 20081102 cvs commit: ports/emulators/qemu Makefile ports/emulators/qemu/files patch-CVE-2008-4539 ports/emulators/qemu-devel Makefile ports/emulators/qemu-devel/files patch-CVE-2008-4539

Hyperlink:http://www.mail-archive.com/cvs-all@freebsd.org/msg129730.html

External Source: DEBIAN

Name: DSA-1799

Hyperlink:http://www.debian.org/security/2009/dsa-1799

External Source: CONFIRM

Name: http://svn.savannah.gnu.org/viewvc/?view=rev&root=qemu&revision=5587

Hyperlink:http://svn.savannah.gnu.org/viewvc/?view=rev&root=qemu&revision=5587

External Source: SECUNIA

Name: 35062

Hyperlink:http://secunia.com/advisories/35062

External Source: SECUNIA

Name: 35031

Hyperlink:http://secunia.com/advisories/35031

External Source: SECUNIA

Name: 34642

Hyperlink:http://secunia.com/advisories/34642

External Source: SECUNIA

Name: 33350

Type: Advisory

Hyperlink:http://secunia.com/advisories/33350

External Source: SECUNIA

Name: 29129

Type: Advisory

Hyperlink:http://secunia.com/advisories/29129

External Source: SECUNIA

Name: 25073

Type: Advisory

Hyperlink:http://secunia.com/advisories/25073

External Source: SUSE

Name: SUSE-SR:2009:008

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

External Source: MLIST

Name: [debian-devel-changes] 20081101 Accepted qemu 0.9.1+svn20081101-1 (source amd64)

Hyperlink:http://groups.google.com/group/linux.debian.changes.devel/msg/9e0dc008572f2867?dmode=source

External Source: CONFIRM

Name: http://git.kernel.dk/?p=qemu.git;a=commitdiff;h=65d35a09979e63541afc5bfc595b9f1b1b4ae069

Hyperlink:http://git.kernel.dk/?p=qemu.git;a=commitdiff;h=65d35a09979e63541afc5bfc595b9f1b1b4ae069

Vulnerable software and versions

Configuration 1

AND

* cpe:/a:kvm_qumranet:kvm:79

* cpe:/a:kvm_qumranet:kvm:78

* cpe:/a:kvm_qumranet:kvm:77

* cpe:/a:kvm_qumranet:kvm:76

* cpe:/a:kvm_qumranet:kvm:75

* cpe:/a:kvm_qumranet:kvm:74

* cpe:/a:kvm_qumranet:kvm:73

* cpe:/a:kvm_qumranet:kvm:80

* cpe:/a:kvm_qumranet:kvm:81 and previous versions

* cpe:/a:kvm_qumranet:kvm:64

* cpe:/a:kvm_qumranet:kvm:65

* cpe:/a:kvm_qumranet:kvm:66

* cpe:/a:kvm_qumranet:kvm:67

* cpe:/a:kvm_qumranet:kvm:68

* cpe:/a:kvm_qumranet:kvm:69

* cpe:/a:kvm_qumranet:kvm:7

* cpe:/a:kvm_qumranet:kvm:71

* cpe:/a:kvm_qumranet:kvm:70

* cpe:/a:kvm_qumranet:kvm:72

* cpe:/a:kvm_qumranet:kvm:62

* cpe:/a:kvm_qumranet:kvm:63

* cpe:/a:kvm_qumranet:kvm:6

* cpe:/a:kvm_qumranet:kvm:55

* cpe:/a:kvm_qumranet:kvm:56

* cpe:/a:kvm_qumranet:kvm:57

* cpe:/a:kvm_qumranet:kvm:58

* cpe:/a:kvm_qumranet:kvm:59

* cpe:/a:kvm_qumranet:kvm:60

* cpe:/a:kvm_qumranet:kvm:61

* cpe:/a:kvm_qumranet:kvm:49

* cpe:/a:kvm_qumranet:kvm:48

* cpe:/a:kvm_qumranet:kvm:47

* cpe:/a:kvm_qumranet:kvm:46

* cpe:/a:kvm_qumranet:kvm:53

* cpe:/a:kvm_qumranet:kvm:52

* cpe:/a:kvm_qumranet:kvm:51

* cpe:/a:kvm_qumranet:kvm:50

* cpe:/a:kvm_qumranet:kvm:5

* cpe:/a:kvm_qumranet:kvm:54

* cpe:/a:kvm_qumranet:kvm:37

* cpe:/a:kvm_qumranet:kvm:41

* cpe:/a:kvm_qumranet:kvm:4

* cpe:/a:kvm_qumranet:kvm:40

* cpe:/a:kvm_qumranet:kvm:39

* cpe:/a:kvm_qumranet:kvm:38

* cpe:/a:kvm_qumranet:kvm:45

* cpe:/a:kvm_qumranet:kvm:44

* cpe:/a:kvm_qumranet:kvm:43

* cpe:/a:kvm_qumranet:kvm:42

* cpe:/a:kvm_qumranet:kvm:32

* cpe:/a:kvm_qumranet:kvm:33

* cpe:/a:kvm_qumranet:kvm:30

* cpe:/a:kvm_qumranet:kvm:31

* cpe:/a:kvm_qumranet:kvm:36

* cpe:/a:kvm_qumranet:kvm:34

* cpe:/a:kvm_qumranet:kvm:35

* cpe:/a:kvm_qumranet:kvm:3

* cpe:/a:kvm_qumranet:kvm:28

* cpe:/a:kvm_qumranet:kvm:29

* cpe:/a:kvm_qumranet:kvm:20

* cpe:/a:kvm_qumranet:kvm:24

* cpe:/a:kvm_qumranet:kvm:21

* cpe:/a:kvm_qumranet:kvm:25

* cpe:/a:kvm_qumranet:kvm:22

* cpe:/a:kvm_qumranet:kvm:19

* cpe:/a:kvm_qumranet:kvm:2

* cpe:/a:kvm_qumranet:kvm:23

* cpe:/a:kvm_qumranet:kvm:26

* cpe:/a:kvm_qumranet:kvm:27

* cpe:/a:kvm_qumranet:kvm:12

* cpe:/a:kvm_qumranet:kvm:13

* cpe:/a:kvm_qumranet:kvm:10

* cpe:/a:kvm_qumranet:kvm:11

* cpe:/a:kvm_qumranet:kvm:18

* cpe:/a:kvm_qumranet:kvm:1

* cpe:/a:kvm_qumranet:kvm:16

* cpe:/a:kvm_qumranet:kvm:17

* cpe:/a:kvm_qumranet:kvm:14

* cpe:/a:kvm_qumranet:kvm:15

* cpe:/a:qemu:qemu

cpe:/o:ubuntu:ubuntu_linux

cpe:/o:debian:linux

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Buffer Errors (CWE-119)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4539