Updated rhevm-spice-client packages that fix multiple security issues are now available for Red Hat Enterprise Virtualization Manager 3.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Enterprise Virtualization Manager provides access to virtual machines using SPICE. These SPICE client packages provide the SPICE client and usbclerk service for both Windows 32-bit operating systems and Windows 64-bit operating systems.

The rhevm-spice-client package includes the mingw-virt-viewer Windows SPICE client. OpenSSL, a general purpose cryptography library with a TLS implementation, is bundled with mingw-virt-viewer. The mingw-virt-viewer package has been updated to correct the following issues :

An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. Note that the disclosed portions of memory could potentially include sensitive information such as private keys.
(CVE-2014-0160)

It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL or DTLS server as a padding oracle. (CVE-2013-0169)

A NULL pointer dereference flaw was found in the way OpenSSL handled TLS/SSL protocol handshake packets. A specially crafted handshake packet could cause a TLS/SSL client using OpenSSL to crash.
(CVE-2013-4353)

It was discovered that the TLS/SSL protocol could leak information about plain text when optional compression was used. An attacker able to control part of the plain text sent over an encrypted TLS/SSL connection could possibly use this flaw to recover other portions of the plain text. (CVE-2012-4929)

Red Hat would like to thank the OpenSSL project for reporting CVE-2014-0160. Upstream acknowledges Neel Mehta of Google Security as the original reporter.

The updated mingw-virt-viewer Windows SPICE client further includes OpenSSL security fixes that have no security impact on mingw-virt-viewer itself. The security fixes included in this update address the following CVE numbers :

CVE-2013-6449, CVE-2013-6450, CVE-2012-2686, and CVE-2013-0166

All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages, which address these issues.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied.  This update contains several security-related fixes for the following component :

  - Apache
  - Bind
  - Certificate Trust Policy
  - ClamAV
  - Installer
  - IPSec
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - QuickTime
  - sudo

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The version of OpenSSL installed on the remote host is prior to 1.0.1d. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1d advisory.

  - OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature     verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL     pointer dereference and application crash) via an invalid key. (CVE-2013-0166)

  - crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in     OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via     crafted CBC data. (CVE-2012-2686)

  - The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and     other products, do not properly consider timing side-channel attacks on a MAC check requirement during the     processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and     plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the Lucky     Thirteen issue. (CVE-2013-0169)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-1732-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2013-0169 and CVE-2012-2686 was reverted in USN-1732-2 because of a regression.
This update restores the security fix, and includes an extra fix from upstream to address the AES-NI regression. We apologize for the inconvenience.

Adam Langley and Wolfgang Ettlingers discovered that OpenSSL incorrectly handled certain crafted CBC data when used with AES-NI. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 12.10. (CVE-2012-2686)

Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in OpenSSL was vulnerable to a timing side-channel attack known as the 'Lucky Thirteen' issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data.
(CVE-2013-0169).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New openssl packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

The remote host is running a version of IBM Tivoli Endpoint Manager Server prior to 8.2.1372. It is, therefore, affected by multiple vulnerabilities :

  - Multiple SSL related denial of service vulnerabilities     exist. (CVE-2012-2686, CVE-2013-0166)

  - An SSL side-channel timing analysis attack allows full     or partial plaintext recovery by a third-party listener.
    (CVE-2013-0169)

  - A cross-site request forgery vulnerability exists in the     Use Analysis Application that can be exploited via a     specially crafted AMF message. (CVE-2013-0452)

  - An unspecified cross-site scripting vulnerability exists     in IBM Tivoli Endpoint Manager Web Reports.
    (CVE-2013-0453)

ID	名稱	產品	系列	已發布	已更新	嚴重性
79013	RHEL 6 : rhevm-spice-client (RHSA-2014:0416)	Nessus	Red Hat Local Security Checks	2014/11/8	2023/4/25	high
69878	Mac OS X Multiple Vulnerabilities (Security Update 2013-004)	Nessus	MacOS X Local Security Checks	2013/9/13	2024/5/28	critical
64534	OpenSSL 1.0.1 < 1.0.1d Multiple Vulnerabilities	Nessus	Web Servers	2013/2/9	2024/10/23	high
65684	Ubuntu 12.04 LTS / 12.10 : openssl vulnerability (USN-1732-3)	Nessus	Ubuntu Local Security Checks	2013/3/26	2022/12/5	medium
64535	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : openssl (SSA:2013-040-01)	Nessus	Slackware Local Security Checks	2013/2/11	2022/12/5	medium
66270	IBM Tivoli Endpoint Manager Server < 8.2.1372 Multiple Vulnerabilities	Nessus	CGI abuses	2013/4/30	2022/12/5	medium

偵測

搜尋 Plugin

high

critical

high

medium

medium

medium