Executive Summary

Informations
Name CVE-2013-4282 First vendor Publication 2013-11-02
Vendor Cve Last vendor Modification 2023-02-13

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4282

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20003
 
Oval ID: oval:org.mitre.oval:def:20003
Title: USN-2027-1 -- spice vulnerability
Description: SPICE could be made to crash if it received specially crafted network traffic.
Family: unix Class: patch
Reference(s): USN-2027-1
CVE-2013-4282
 Version: 5
Platform(s): Ubuntu 13.10
Ubuntu 13.04
 Product(s): spice
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20572
 
Oval ID: oval:org.mitre.oval:def:20572
Title: DSA-2839-1 spice - denial of service
Description: Multiple vulnerabilities have been found in spice, a SPICE protocol client and server library.
Family: unix Class: patch
Reference(s): DSA-2839-1
CVE-2013-4130
CVE-2013-4282
 Version: 5
Platform(s): Debian GNU/Linux 7
Debian GNU/kFreeBSD 7
 Product(s): spice
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21163
 
Oval ID: oval:org.mitre.oval:def:21163
Title: RHSA-2013:1474: qspice security update (Important)
Description: Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.
Family: unix Class: patch
Reference(s): RHSA-2013:1474-00
CESA-2013:1474
CVE-2013-4282
 Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): qspice
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21183
 
Oval ID: oval:org.mitre.oval:def:21183
Title: RHSA-2013:1473: spice-server security update (Important)
Description: Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.
Family: unix Class: patch
Reference(s): RHSA-2013:1473-00
CESA-2013:1473
CVE-2013-4282
 Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): spice-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23604
 
Oval ID: oval:org.mitre.oval:def:23604
Title: ELSA-2013:1474: qspice security update (Important)
Description: Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.
Family: unix Class: patch
Reference(s): ELSA-2013:1474-00
CVE-2013-4282
 Version: 6
Platform(s): Oracle Linux 5
 Product(s): qspice
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24109
 
Oval ID: oval:org.mitre.oval:def:24109
Title: ELSA-2013:1473: spice-server security update (Important)
Description: Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket.
Family: unix Class: patch
Reference(s): ELSA-2013:1473-00
CVE-2013-4282
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): spice-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26511
 
Oval ID: oval:org.mitre.oval:def:26511
Title: DEPRECATED: ELSA-2013-1473 -- spice-server security update (important)
Description: [0.12.0-12.5] - Fix issue with error-handling of RSA_private_decrypt() in previous patch Related: CVE-2013-4282 [0.12.0-12.el6_4.4] - Fix buffer overflow when decrypting client SPICE ticket Resolves: CVE-2013-4282
Family: unix Class: patch
Reference(s): ELSA-2013-1473
CVE-2013-4282
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): spice-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27020
 
Oval ID: oval:org.mitre.oval:def:27020
Title: DEPRECATED: ELSA-2013-1474 -- qspice security update (important)
Description: [0.3.0-56.1] - Fix spice-server crash when client sends a password which is too long Resolves: CVE-2013-4282 [0.3.0-56.el5] - Fix unsafe accesses + spice: drop libpng from windows components (537849) + libspice: fix unsafe guest data accessing Resolves: #568720 + fix unsafe free() call. Resolves: #568724 + spice server: fix unsafe cursor items handling. Resolves: #568720 [0.3.0-55.el5] - spice: clear client palette caches on migration Resolves: #599496
Family: unix Class: patch
Reference(s): ELSA-2013-1474
CVE-2013-4282
 Version: 4
Platform(s): Oracle Linux 5
 Product(s): qspice
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28279
 
Oval ID: oval:org.mitre.oval:def:28279
Title: SUSE-SU-2015:0884-1 -- Security update for spice (important)
Description: The remote desktop software SPICE was updated to address one security issue. The following vulnerabilitiy was fixed: * A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282)
Family: unix Class: patch
Reference(s): SUSE-SU-2015:0884-1
CVE-2013-4282
 Version: 3
Platform(s): SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
 Product(s): spice
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Os 2

Nessus® Vulnerability Scanner

Date Description
2015-10-15 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-657.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0884-1.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1460.nasl - Type : ACT_GATHER_INFO
2014-01-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-016.nasl - Type : ACT_GATHER_INFO
2014-01-09 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2839.nasl - Type : ACT_GATHER_INFO
2013-11-13 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2027-1.nasl - Type : ACT_GATHER_INFO
2013-11-11 Name : The remote Fedora host is missing a security update.
File : fedora_2013-20310.nasl - Type : ACT_GATHER_INFO
2013-11-08 Name : The remote Fedora host is missing a security update.
File : fedora_2013-20340.nasl - Type : ACT_GATHER_INFO
2013-11-08 Name : The remote Fedora host is missing a security update.
File : fedora_2013-20360.nasl - Type : ACT_GATHER_INFO
2013-10-31 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131029_spice_server_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-10-31 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131029_qspice_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-30 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1474.nasl - Type : ACT_GATHER_INFO
2013-10-30 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1474.nasl - Type : ACT_GATHER_INFO
2013-10-30 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1473.nasl - Type : ACT_GATHER_INFO
2013-10-30 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1473.nasl - Type : ACT_GATHER_INFO
2013-10-30 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1473.nasl - Type : ACT_GATHER_INFO
2013-10-30 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1474.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/63408
CONFIRM http://cgit.freedesktop.org/spice/spice/commit/?id=8af619009660b24e0b41ad26b3...
DEBIAN http://www.debian.org/security/2014/dsa-2839
REDHAT http://rhn.redhat.com/errata/RHSA-2013-1460.html
http://rhn.redhat.com/errata/RHSA-2013-1473.html
http://rhn.redhat.com/errata/RHSA-2013-1474.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00008.html
UBUNTU http://www.ubuntu.com/usn/USN-2027-1

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Date Informations
2023-02-13 09:28:21
  • Multiple Updates
2023-02-03 00:28:37
  • Multiple Updates
2021-05-04 12:27:12
  • Multiple Updates
2021-04-22 01:32:55
  • Multiple Updates
2020-05-23 00:37:56
  • Multiple Updates
2019-04-22 21:19:08
  • Multiple Updates
2017-01-03 09:22:51
  • Multiple Updates
2016-11-29 00:24:49
  • Multiple Updates
2016-04-26 23:31:49
  • Multiple Updates
2015-10-16 13:24:31
  • Multiple Updates
2015-05-21 13:30:46
  • Multiple Updates
2014-11-08 13:31:06
  • Multiple Updates
2014-02-17 11:21:55
  • Multiple Updates
2014-01-24 13:19:21
  • Multiple Updates
2013-12-08 13:19:31
  • Multiple Updates
2013-11-12 17:19:15
  • Multiple Updates
2013-11-05 00:22:28
  • Multiple Updates
2013-11-03 00:19:24
  • First insertion