PT-2013-4863 · Red Hat+1 · Spice+2

Published 2013-07-15 · Updated 2014-01-24 · CVE-2013-4130

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SPICE versions prior to 0.12.4

Description The issue is related to the red channel pipes add type and red channel pipes add empty msg functions in server/red channel.c. These functions do not properly perform ring loops, which might allow remote attackers to cause a denial of service by triggering a network error, leading to a reachable assertion and server exit.

Recommendations For versions prior to 0.12.4, update to version 0.12.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the red channel pipes add type and red channel pipes add empty msg functions until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CESA-2013_1192

CVE-2013-4130

DSA-2839-1

MGASA-2013-0255

RHSA-2013:1192

RHSA-2013:1260

RHSA-2013_1192

USN-1926-1

Affected Products

Centos

Red Hat

Spice

References · 28

• https://osv.dev/vulnerability/CVE-2013-4130 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4130 · Security Note
• http://cgit.freedesktop.org/spice/spice/commit/?id=53488f0275d6c8a121af49f7ac817d09ce68090d · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4130 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4130 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-1192.html · Vendor Advisory
• http://debian.org/security/2014/dsa-2839 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4130 · Vendor Advisory
• http://ubuntu.com/usn/USN-1926-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4130 · Security Note
• https://ubuntu.com/security/CVE-2013-4130 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0255 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1926-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0255.html · Security Note