PT-2013-4863 · Red Hat+1 · Spice+2

Publicado 2013-07-15 · Atualizado 2014-01-24 · CVE-2013-4130

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SPICE versions prior to 0.12.4

Description The issue is related to the red channel pipes add type and red channel pipes add empty msg functions in server/red channel.c. These functions do not properly perform ring loops, which might allow remote attackers to cause a denial of service by triggering a network error, leading to a reachable assertion and server exit.

Recommendations For versions prior to 0.12.4, update to version 0.12.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the red channel pipes add type and red channel pipes add empty msg functions until a patch is available.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CESA-2013_1192

CVE-2013-4130

DSA-2839-1

MGASA-2013-0255

RHSA-2013:1192

RHSA-2013:1260

RHSA-2013_1192

USN-1926-1

Produtos afetados

Centos

Red Hat

Spice

Referências · 28

• https://osv.dev/vulnerability/CVE-2013-4130 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4130 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4130 · Nota de Segurança
• https://lists.centos.org/pipermail/centos-announce/2013-September/069398.html · Nota
• http://cgit.freedesktop.org/spice/spice/commit/?id=53488f0275d6c8a121af49f7ac817d09ce68090d · Correção
• https://lists.centos.org/pipermail/centos-announce/2013-September/031961.html · Nota
• https://bugs.mageia.org/show_bug.cgi?id=10987 · Nota
• https://access.redhat.com/security/cve/CVE-2013-4130 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4130 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2013-September/056842.html · Nota
• https://cve.org/CVERecord?id=CVE-2013-4130 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2013-1192.html · Aviso do Fabricante
• http://debian.org/security/2014/dsa-2839 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-4130 · Aviso do Fabricante
• http://seclists.org/oss-sec/2013/q3/115 · Nota