PT-2015-3067 · Qemu+3 · Qemu+3

Qinghao Tang

·

Publicado

2015-09-11

·

Atualizado

2024-06-15

·

CVE-2015-6855

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)
Description The issue is related to the QEMU emulator's handling of ATAPI devices, where it fails to properly restrict commands accepted from these devices. This can be exploited by a remote attacker to cause a denial of service or possibly other unspecified impacts by using certain IDE commands. For example, sending a WIN READ NATIVE MAX command to an empty drive can trigger a divide-by-zero error, leading to an instance crash.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Divide By Zero

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264CWE-369

Identificadores relacionados

ALT-PU-2015-2158
BDU:2016-00272
CVE-2015-6855
DSA-3361-1
DSA-3362-1
MGASA-2015-0368
MGASA-2015-0369
OPENSUSE-SU-2016_0914-1
OPENSUSE-SU-2016_0995-1
OPENSUSE-SU-2024:10196-1
OPENSUSE-SU-2024:11287-1
SUSE-SU-2015:1782-1
SUSE-SU-2016:0873-1
SUSE-SU-2016:0955-1
SUSE-SU-2016:1318-1
SUSE-SU-2016:1698-1
SUSE-SU-2016:1745-1
SUSE-SU-2016:1785-1
USN-2745-1

Produtos afetados

Alt Linux
Qemu
Suse
Ubuntu