PT-2013-1144 · Qemu+4 · Qemu+5

Asias He · Publicado 2013-10-04 · Atualizado 2020-08-11 · CVE-2013-4344

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified) SUSE Linux Enterprise (affected versions not specified)

Description The issue concerns a buffer overflow in the SCSI implementation, potentially allowing local users to gain privileges. This could lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation can be carried out locally by an authenticated attacker.

Recommendations For QEMU, consider restricting access to the SCSI implementation until a patch is available. For SUSE Linux Enterprise, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

ALT-PU-2013-1219

BDU:2015-04319

CESA-2013_1553

CVE-2013-4344

DSA-2932-1

DSA-2933-1

MGASA-2013-0341

OPENSUSE-SU-2014_1279-1

OPENSUSE-SU-2014_1281-1

RHSA-2013:1527

RHSA-2013:1553

RHSA-2013:1754

RHSA-2013_1553

SUSE-SU-2014_1318-1

SUSE-SU-2015:0870-1

SUSE-SU-2015:0889-1

SUSE-SU-2015:1152-1

Produtos afetados

Alt Linux

Centos

Qemu

Red Hat

Suse Linux Enterprise

Suse

Referências · 87

• http://rhn.redhat.com/errata/RHSA-2013-1553.html · Aviso do Fabricante
• http://support.novell.com/security/cve/CVE-2014-3968.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4148 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=878841 · Nota
• https://osv.dev/vulnerability/MGASA-2013-0341 · Aviso do Fabricante
• http://support.novell.com/security/cve/CVE-2014-4021.html · Nota
• https://bugzilla.suse.com/show_bug.cgi?id=895798 · Nota
• http://support.novell.com/security/cve/CVE-2014-2599.html · Nota
• http://rhn.redhat.com/errata/RHSA-2013-1754.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4344 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9718 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=862608 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-November/027332.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4151 · Nota de Segurança
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota