Executive Summary
Summary | |
---|---|
Title | hypervkvpd security and bug fix update |
Informations | |||
---|---|---|---|
Name | RHSA-2013:0807 | First vendor Publication | 2013-05-09 |
Vendor | RedHat | Last vendor Modification | 2013-05-09 |
Severity (Vendor) | Low | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:N/I:N/A:C) | |||
---|---|---|---|
Cvss Base Score | 4.9 | Attack Range | Local |
Cvss Impact Score | 6.9 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: An updated hypervkvpd package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEL Desktop Multi OS (v. 5 client) - i386, x86_64 RHEL Virtualization (v. 5 server) - i386, ia64, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: The hypervkvpd package contains hypervkvpd, the guest Microsoft Hyper-V Key-Value Pair (KVP) daemon. The daemon passes basic information to the host through VMBus, such as the guest IP address, fully qualified domain name, operating system name, and operating system release number. A denial of service flaw was found in the way hypervkvpd processed certain Netlink messages. A local, unprivileged user in a guest (running on Microsoft Hyper-V) could send a Netlink message that, when processed, would cause the guest's hypervkvpd daemon to exit. (CVE-2012-5532) The CVE-2012-5532 issue was discovered by Florian Weimer of the Red Hat Product Security Team. This update also fixes the following bug: * The hypervkvpd daemon did not close the file descriptors for pool files when they were updated. This could eventually lead to hypervkvpd crashing with a "KVP: Failed to open file, pool: 1" error after consuming all available file descriptors. With this update, the file descriptors are closed, correcting this issue. (BZ#953502) Users of hypervkvpd are advised to upgrade to this updated package, which contains backported patches to correct these issues. After installing the update, it is recommended to reboot all guest machines. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 877572 - CVE-2012-5532 hypervkvpd: Netlink source address validation allows denial of service 953502 - hypervkvpd dies from time to time with "KVP: Failed to open file, pool: 1" |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2013-0807.html |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:17314 | |||
Oval ID: | oval:org.mitre.oval:def:17314 | ||
Title: | USN-1699-1 -- linux vulnerabilities | ||
Description: | Several security issues were fixed in the kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1699-1 CVE-2012-4461 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.10 | Product(s): | linux |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17337 | |||
Oval ID: | oval:org.mitre.oval:def:17337 | ||
Title: | USN-1696-1 -- linux vulnerabilities | ||
Description: | Several security issues were fixed in the kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1696-1 CVE-2012-4461 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.04 | Product(s): | linux |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17680 | |||
Oval ID: | oval:org.mitre.oval:def:17680 | ||
Title: | USN-1698-1 -- linux-ti-omap4 vulnerabilities | ||
Description: | Several security issues were fixed in the kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1698-1 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.04 | Product(s): | linux-ti-omap4 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:17779 | |||
Oval ID: | oval:org.mitre.oval:def:17779 | ||
Title: | USN-1700-1 -- linux-ti-omap4 vulnerabilities | ||
Description: | Several security issues were fixed in the kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1700-1 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.10 | Product(s): | linux-ti-omap4 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:17858 | |||
Oval ID: | oval:org.mitre.oval:def:17858 | ||
Title: | USN-1700-2 -- linux-ti-omap4 regression | ||
Description: | USN-1700-1 introduced a regression in the Linux kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1700-2 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.10 | Product(s): | linux-ti-omap4 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:17894 | |||
Oval ID: | oval:org.mitre.oval:def:17894 | ||
Title: | USN-1696-2 -- linux regression | ||
Description: | USN-1696-1 introduced a regression in the Linux kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1696-2 CVE-2012-4461 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.04 | Product(s): | linux |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:18011 | |||
Oval ID: | oval:org.mitre.oval:def:18011 | ||
Title: | USN-1698-2 -- linux-ti-omap4 regression | ||
Description: | USN-1698-1 introduced a regression in the Linux kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1698-2 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.04 | Product(s): | linux-ti-omap4 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:18036 | |||
Oval ID: | oval:org.mitre.oval:def:18036 | ||
Title: | USN-1704-2 -- linux-lts-quantal - Linux kernel hardware enablement from Quantal regression | ||
Description: | USN-1704-1 introduced a regression in the Linux kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1704-2 CVE-2012-0957 CVE-2012-4461 CVE-2012-4508 CVE-2012-4530 CVE-2012-4565 CVE-2012-5517 CVE-2012-5532 | Version: | 8 |
Platform(s): | Ubuntu 12.04 | Product(s): | linux-lts-quantal |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:18124 | |||
Oval ID: | oval:org.mitre.oval:def:18124 | ||
Title: | USN-1699-2 -- linux regression | ||
Description: | USN-1699-1 introduced a regression in the Linux kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1699-2 CVE-2012-4461 CVE-2012-4530 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 12.10 | Product(s): | linux |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:18186 | |||
Oval ID: | oval:org.mitre.oval:def:18186 | ||
Title: | USN-1726-1 -- linux-ti-omap4 vulnerabilities | ||
Description: | Several security issues were fixed in the kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1726-1 CVE-2012-2669 CVE-2012-4508 CVE-2012-5532 | Version: | 7 |
Platform(s): | Ubuntu 11.10 | Product(s): | linux-ti-omap4 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:21185 | |||
Oval ID: | oval:org.mitre.oval:def:21185 | ||
Title: | RHSA-2013:0807: hypervkvpd security and bug fix update (Low) | ||
Description: | The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2013:0807-00 CESA-2013:0807 CVE-2012-5532 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | hypervkvpd |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23524 | |||
Oval ID: | oval:org.mitre.oval:def:23524 | ||
Title: | ELSA-2013:0807: hypervkvpd security and bug fix update (Low) | ||
Description: | The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013:0807-00 CVE-2012-5532 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | hypervkvpd |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27059 | |||
Oval ID: | oval:org.mitre.oval:def:27059 | ||
Title: | DEPRECATED: ELSA-2013-0807 -- hypervkvpd security and bug fix update (low) | ||
Description: | [0-0.7.0.1.el5_9.3] - Add support for oracle os [0-0.7.3] - Fix for one more file descriptor leak (rhbz#953502) [0-0.7.2] - Validate Netlink source address (CVE-2012-5532) (rhbz#953560) [0-0.7.1] - Fix for file descriptor leak (rhbz#953502) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013-0807 CVE-2012-5532 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | hypervkvpd |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2013-0807.nasl - Type : ACT_GATHER_INFO |
2013-06-25 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-176.nasl - Type : ACT_GATHER_INFO |
2013-05-14 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2013-0807.nasl - Type : ACT_GATHER_INFO |
2013-05-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0807.nasl - Type : ACT_GATHER_INFO |
2013-05-10 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130509_hypervkvpd_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2013-02-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1726-1.nasl - Type : ACT_GATHER_INFO |
2013-02-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1720-1.nasl - Type : ACT_GATHER_INFO |
2013-02-04 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1696-2.nasl - Type : ACT_GATHER_INFO |
2013-02-04 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1699-2.nasl - Type : ACT_GATHER_INFO |
2013-02-04 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1704-2.nasl - Type : ACT_GATHER_INFO |
2013-02-03 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1698-2.nasl - Type : ACT_GATHER_INFO |
2013-02-03 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1700-2.nasl - Type : ACT_GATHER_INFO |
2013-01-23 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1704-1.nasl - Type : ACT_GATHER_INFO |
2013-01-18 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1698-1.nasl - Type : ACT_GATHER_INFO |
2013-01-18 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1699-1.nasl - Type : ACT_GATHER_INFO |
2013-01-18 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1700-1.nasl - Type : ACT_GATHER_INFO |
2013-01-18 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1696-1.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:57:11 |
|
2013-05-10 00:18:29 |
|