PT-2008-3471 · Qemu+1 · Qemu+1

Avi Kivity · Publicado 2008-08-08 · Atualizado 2024-06-15 · CVE-2008-1945

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions QEMU version 0.9.0

Description The issue arises from improper handling of changes to removable media, allowing guest OS users to read arbitrary files on the host OS. This is achieved by modifying the disk-image header using the diskformat: parameter in the -usbdevice option to identify a different format.

Recommendations For QEMU version 0.9.0, consider restricting access to the -usbdevice option or avoiding the use of the diskformat: parameter until a fix is available. As a temporary workaround, restrict the ability of guest OS users to modify removable media settings to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2008-1945

DSA-1799-1

OPENSUSE-SU-2024:10233-1

OPENSUSE-SU-2024:10285-1

RHSA-2008:0892

RHSA-2008_0892

Produtos afetados

Qemu

Red Hat

Referências · 76

• https://suse.com/security/cve/CVE-2013-4531 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-1945 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-776-1 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9905 · Nota
• https://suse.com/security/cve/CVE-2013-4527 · Nota
• http://securityfocus.com/bid/30604 · Nota
• https://suse.com/security/cve/CVE-2013-4150 · Nota
• https://suse.com/security/cve/CVE-2014-0147 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44269 · Nota
• https://suse.com/security/cve/CVE-2016-4453 · Nota
• https://suse.com/security/cve/CVE-2013-4541 · Nota
• https://suse.com/security/cve/CVE-2016-4439 · Nota
• https://suse.com/security/cve/CVE-2014-0182 · Nota
• http://secunia.com/advisories/32088 · Nota
• https://suse.com/security/cve/CVE-2013-4533 · Nota