Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.0664
Important: rhevm-spice-client security, bug fix, and enhancement update
19 March 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rhevm-spice-client
Publisher: Red Hat
Operating System: Red Hat
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2014-9029 CVE-2014-8158 CVE-2014-8157
CVE-2014-8138 CVE-2014-8137 CVE-2014-3566
CVE-2011-4517 CVE-2011-4516 CVE-2008-3522
CVE-2008-3520
Reference: ASB-2015.0009
ESB-2015.0223
ESB-2015.0200
ESB-2015.0165
ESB-2015.0164
ASB-2014.0146
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2015-0698.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: rhevm-spice-client security, bug fix, and enhancement update
Advisory ID: RHSA-2015:0698-01
Product: Red Hat Enterprise Virtualization
Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0698.html
Issue date: 2015-03-18
CVE Names: CVE-2008-3520 CVE-2008-3522 CVE-2011-4516
CVE-2011-4517 CVE-2014-8137 CVE-2014-8138
CVE-2014-8157 CVE-2014-8158 CVE-2014-9029
=====================================================================
1. Summary:
Updated rhevm-spice-client packages that fix multiple security issues,
several bugs, and add one enhancement are now available for Red Hat
Enterprise Virtualization Manager 3.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Relevant releases/architectures:
RHEV-M 3.5 - noarch
3. Description:
Red Hat Enterprise Virtualization Manager provides access to virtual
machines using SPICE. These SPICE client packages provide the SPICE client
and usbclerk service for both Windows 32-bit operating systems and Windows
64-bit operating systems.
This update adds support for the TLS Fallback Signaling Cipher Suite Value
(TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade
attacks against applications which re-connect using a lower SSL/TLS
protocol version when the initial connection indicating the highest
supported protocol version fails.
This can prevent a forceful downgrade of the communication to SSL 3.0.
The SSL 3.0 protocol was found to be vulnerable to the padding oracle
attack when using block cipher suites in cipher block chaining (CBC) mode.
This issue is identified as CVE-2014-3566, and also known under the alias
POODLE. This SSL 3.0 protocol flaw will not be addressed in a future
update; it is recommended that users configure their applications to
require at least TLS protocol version 1.0 for secure communication.
For additional information about this flaw, see the Knowledgebase article
at https://access.redhat.com/articles/1232123
Multiple flaws were found in the way JasPer decoded JPEG 2000 image files.
A specially crafted file could cause an application using JasPer to crash
or, possibly, execute arbitrary code. (CVE-2014-8138, CVE-2014-8157,
CVE-2014-8158, CVE-2014-9029, CVE-2014-8137, CVE-2011-4516, CVE-2011-4517,
CVE-2008-3520, CVE-2008-3522)
Red Hat would like to thank oCERT for reporting CVE-2014-8137,
CVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2011-4516,
and CVE-2011-4517. oCERT acknowledges Jose Duart of the Google Security
Team as the original reporter of CVE-2014-8137 and CVE-2014-8138; and
pyddeh as the original reporter of CVE-2014-8157 and CVE-2014-8158.
The mingw-openssl and mingw-jasper packages have been upgraded to the
latest upstream version, which provides a number of bug fixes and
enhancements over the previous version. (BZ#1187585)
This update also fixes the following bugs:
* Previously, a guest system installed with tools incorrectly always
started in full screen mode, even when the "Open in Full Screen" option was
unchecked in console options. Now, when connecting in window mode with the
option unchecked, the guest system starts in a window as expected.
(BZ#1172126)
* Prior to this update, copying and pasting of images from the client to
the guest did not work when spice-gtk was built from upstream. Now, images
can be copied and pasted without problems. (BZ#1187270)
In addition, this update adds the following enhancement:
* Administrators now have the option of automatic multiuser installation of
virt-viewer onto many client workstations. (BZ#1187272)
All rhevm-spice-client users are advised to upgrade to these updated
packages, which correct these issues and add these enhancement.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
461476 - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls
461478 - CVE-2008-3522 jasper: possible buffer overflow in jas_stream_printf()
747726 - CVE-2011-4516 CVE-2011-4517 jasper: heap buffer overflow flaws lead to arbitrary code execution (CERT VU#887409)
1167537 - CVE-2014-9029 jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009)
1172126 - always fullscreen for SPICE-xpi
1173157 - CVE-2014-8137 jasper: double-free in in jas_iccattrval_destroy() (oCERT-2014-012)
1173162 - CVE-2014-8138 jasper: heap overflow in jp2_decode() (oCERT-2014-012)
1179282 - CVE-2014-8157 jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)
1179298 - CVE-2014-8158 jasper: unrestricted stack memory use in jpc_qmfb.c (oCERT-2015-001)
1187270 - copy/paste images does not work -- images are truncated
6. Package List:
RHEV-M 3.5:
Source:
rhevm-spice-client-3.5-3.el6.src.rpm
noarch:
rhevm-spice-client-x64-cab-3.5-3.el6.noarch.rpm
rhevm-spice-client-x64-msi-3.5-3.el6.noarch.rpm
rhevm-spice-client-x86-cab-3.5-3.el6.noarch.rpm
rhevm-spice-client-x86-msi-3.5-3.el6.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2008-3520
https://access.redhat.com/security/cve/CVE-2008-3522
https://access.redhat.com/security/cve/CVE-2011-4516
https://access.redhat.com/security/cve/CVE-2011-4517
https://access.redhat.com/security/cve/CVE-2014-8137
https://access.redhat.com/security/cve/CVE-2014-8138
https://access.redhat.com/security/cve/CVE-2014-8157
https://access.redhat.com/security/cve/CVE-2014-8158
https://access.redhat.com/security/cve/CVE-2014-9029
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2015 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFVCW1JXlSAg2UNWIIRAj17AJ9D5Ru9tGR35TSGT8iu/yJSU600IgCgi4sI
rMWgPfb/bHCRBSJZHtlQ6b4=
=F97H
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVQoRThLndAQH1ShLAQIkVg//djNamtj7QqXcNoFZ+YNsHbRWwF43iB42
3gxDZh3W/7oCQasegNzYC3EastF8un74ZlVapQ/kJe3XrIYcu9cC3ga+0SLKP25H
nlqHmTs8yMf45jSNtNI7H81ow2ephGX8LUos5iuQ/7aLI1mNefTS61rWUQYtKnb6
MmQ8ssph20ipgiPYejaYFoBYHqEtfsOyEhkZdYMRuOUycBtk3S7muneyM5o6NA0i
pNLhICz3z8WFh/dN1JJpZPaaeeOiyfmbA920yqL7McCQrF+e1/QRpJtz2ucc4Wtc
5EKVsYs3NmxJVLBKw/wYahNGbKM2KhKl4UkGQXmW+2+g73CSuQwn+jpm9yMFXzVJ
YTpPo4ZpyQgoGnZCTWjMDGq+EY5PAIYk178Vp6EZGNyvbNnFRR1yc8XLedVc9Mnq
3h4MH3CrSZQ43zG18xix3ehU7aYBqjMUIaA/e2ma4lxUtXkiLY5gKV1LDjSWpI/K
H3E7QcitsAMs/z95KwEbKMglb2nrRJRX/du5TBkcufXYS/Ogf7awgX1JLNicAC8P
62ldbi90Y8V22yB721deQjM4tDY/Ht6Oe720ah6xIPCzNxEoWDivdjR94aSo2F54
eqIuj0pwg7aRg6bRZA+hcOBRFUYHFIKk0JpJt/HQJdCGg/T4MJuUEJ82s7oUj+z/
6FmwF3IIYmg=
=a465
-----END PGP SIGNATURE-----