ID

VAR-201505-0417


CVE

CVE-2015-3456


TITLE

QEMU 'hw/block/fdc.c' VENOM Remote Memory Corruption Vulnerability

Trust: 0.3

sources: BID: 74640

DESCRIPTION

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. QEMU is prone to a remote memory-corruption vulnerability because the application fails to perform adequate boundary-checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. 6) - i386, x86_64 3. Release Date: 2015-05-21 Last Updated: 2015-05-21 Potential Security Impact: Denial of Service (DoS), Execution of Arbitary Code Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has identitfied with HP Helion OpenStack. Notes: - This is the vulnerability known as "Virtual Environment Neglected Operations Manipulation"also known as "VENOM". - This vulnerability exists in the floppy disk controller driver of QEMU, an open-source virtualization technology used to provision guest Virtual Machines. - This vulnerability affects all versions of QEMU and could lead to hypervisor breakout, where a user of the guest VM can gain control of the host. HP Helion OpenStack leverages QEMU as a core part of its virtualization functionality and is therefore affected by this vulnerability. - Due to the careful application of sVirt and AppArmor policies the attacker's ability to pivot after successfully exploiting the vulnerability is significantly reduced. References: CVE-2015-3456 (SSRT102076) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Helion OpenStack software: HP Helion OpenStack 1.0.0 HP Helion OpenStack 1.1.0 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-3456 (AV:A/AC:L/Au:S/C:C/I:C/A:C) 7.7 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following software update to resolve the vulnerability in HP Helion OpenStack. The latest Helion OpenStack software can be downloaded by the following steps: 2. Go to https://helion.hpwsportal.com 3. Find the Helion OpenStack compressed package version 1.1.1 and download the package Follow the deployment steps in the following link: http://docs.hpcloud.com/helion/openstack/1.1.1/update HP Helion OpenStack Upgrade Version HP Helion OpenStack 1.0.0, 1.1.0 HP Helion OpenStack 1.1.1 Note: HP Helion 1.0.0 and 1.1.0 customers are advised to migrate their deployments to version 1.1.1. HISTORY Version:1 (rev.1) - 21 May 2015 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. Relevant releases/architectures: RHEL 7-based RHEV-H - noarch RHEV Hypervisor for RHEL-6 - noarch 3. The following steps are recommended by Red Hat ( https://access.redhat.com/articles/1444903 ) and must be applied for each control plane and data plane node that is using KVM for virtualization: Login to the node Upgrade the QEMU package for your system using the command: 'yum update qemu-kvm'. A full system update may be applied using the command 'yum update'. Refer to the HP Helion CloudSystem administrative guide ( http://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docI d=c04376928 ) for instructions on restarting appliances. 5 client) - x86_64 RHEL Virtualization (v. 5 server) - x86_64 3. Note: The procedure in the Solution section must be performed before this update will take effect. 2) Either reboot the hypervisor machine or, as the root user, remove (using "modprobe -r [module]") and reload (using "modprobe [module]") all of the following modules which are currently running (determined using "lsmod"): kvm, ksm, kvm-intel or kvm-amd. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: qemu-kvm security update Advisory ID: RHSA-2015:0999-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0999.html Issue date: 2015-05-13 CVE Names: CVE-2015-3456 ===================================================================== 1. Summary: Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. (CVE-2015-3456) Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1218611 - CVE-2015-3456 qemu: fdc: out-of-bounds fifo buffer memory access 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: qemu-kvm-1.5.3-86.el7_1.2.src.rpm x86_64: libcacard-1.5.3-86.el7_1.2.i686.rpm libcacard-1.5.3-86.el7_1.2.x86_64.rpm qemu-img-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-common-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.i686.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-tools-1.5.3-86.el7_1.2.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: libcacard-devel-1.5.3-86.el7_1.2.i686.rpm libcacard-devel-1.5.3-86.el7_1.2.x86_64.rpm libcacard-tools-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.i686.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: qemu-kvm-1.5.3-86.el7_1.2.src.rpm x86_64: libcacard-1.5.3-86.el7_1.2.i686.rpm libcacard-1.5.3-86.el7_1.2.x86_64.rpm libcacard-devel-1.5.3-86.el7_1.2.i686.rpm libcacard-devel-1.5.3-86.el7_1.2.x86_64.rpm libcacard-tools-1.5.3-86.el7_1.2.x86_64.rpm qemu-img-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-common-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.i686.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-tools-1.5.3-86.el7_1.2.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: qemu-kvm-1.5.3-86.el7_1.2.src.rpm ppc64: qemu-img-1.5.3-86.el7_1.2.ppc64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.ppc64.rpm x86_64: libcacard-1.5.3-86.el7_1.2.i686.rpm libcacard-1.5.3-86.el7_1.2.x86_64.rpm qemu-img-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-common-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.i686.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-tools-1.5.3-86.el7_1.2.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: libcacard-1.5.3-86.el7_1.2.ppc.rpm libcacard-1.5.3-86.el7_1.2.ppc64.rpm libcacard-devel-1.5.3-86.el7_1.2.ppc.rpm libcacard-devel-1.5.3-86.el7_1.2.ppc64.rpm libcacard-tools-1.5.3-86.el7_1.2.ppc64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.ppc.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.ppc64.rpm x86_64: libcacard-devel-1.5.3-86.el7_1.2.i686.rpm libcacard-devel-1.5.3-86.el7_1.2.x86_64.rpm libcacard-tools-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.i686.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: qemu-kvm-1.5.3-86.el7_1.2.src.rpm x86_64: libcacard-1.5.3-86.el7_1.2.i686.rpm libcacard-1.5.3-86.el7_1.2.x86_64.rpm qemu-img-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-common-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.i686.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-tools-1.5.3-86.el7_1.2.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: libcacard-devel-1.5.3-86.el7_1.2.i686.rpm libcacard-devel-1.5.3-86.el7_1.2.x86_64.rpm libcacard-tools-1.5.3-86.el7_1.2.x86_64.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.i686.rpm qemu-kvm-debuginfo-1.5.3-86.el7_1.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-3456 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVU1swXlSAg2UNWIIRAshIAKCZWkFNWcyvUBOx0PV9ta8YOtLgbgCdFbuw V78Qd9SnhHVz0MTvjdFcFu0= =+Vrr -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . For the oldstable distribution (wheezy), these problems have been fixed in version 1.1.2+dfsg-6a+deb7u7 of the qemu source package and in version 1.1.2+dfsg-6+deb7u7 of the qemu-kvm source package. Only CVE-2015-3456 affects oldstable. For the stable distribution (jessie), these problems have been fixed in version 1:2.1+dfsg-12. For the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your qemu packages. ============================================================================ Ubuntu Security Notice USN-2608-1 May 13, 2015 qemu, qemu-kvm vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.04 - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in QEMU. Software Description: - qemu: Machine emulator and virtualizer - qemu-kvm: Machine emulator and virtualizer Details: Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2015-3456) Daniel P. Berrange discovered that QEMU incorrectly handled VNC websockets. A remote attacker could use this issue to cause QEMU to consume memory, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-1779) Jan Beulich discovered that QEMU, when used with Xen, didn't properly restrict access to PCI command registers. A malicious guest could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2756) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.04: qemu-system 1:2.2+dfsg-5expubuntu9.1 qemu-system-aarch64 1:2.2+dfsg-5expubuntu9.1 qemu-system-arm 1:2.2+dfsg-5expubuntu9.1 qemu-system-mips 1:2.2+dfsg-5expubuntu9.1 qemu-system-misc 1:2.2+dfsg-5expubuntu9.1 qemu-system-ppc 1:2.2+dfsg-5expubuntu9.1 qemu-system-sparc 1:2.2+dfsg-5expubuntu9.1 qemu-system-x86 1:2.2+dfsg-5expubuntu9.1 Ubuntu 14.10: qemu-system 2.1+dfsg-4ubuntu6.6 qemu-system-aarch64 2.1+dfsg-4ubuntu6.6 qemu-system-arm 2.1+dfsg-4ubuntu6.6 qemu-system-mips 2.1+dfsg-4ubuntu6.6 qemu-system-misc 2.1+dfsg-4ubuntu6.6 qemu-system-ppc 2.1+dfsg-4ubuntu6.6 qemu-system-sparc 2.1+dfsg-4ubuntu6.6 qemu-system-x86 2.1+dfsg-4ubuntu6.6 Ubuntu 14.04 LTS: qemu-system 2.0.0+dfsg-2ubuntu1.11 qemu-system-aarch64 2.0.0+dfsg-2ubuntu1.11 qemu-system-arm 2.0.0+dfsg-2ubuntu1.11 qemu-system-mips 2.0.0+dfsg-2ubuntu1.11 qemu-system-misc 2.0.0+dfsg-2ubuntu1.11 qemu-system-ppc 2.0.0+dfsg-2ubuntu1.11 qemu-system-sparc 2.0.0+dfsg-2ubuntu1.11 qemu-system-x86 2.0.0+dfsg-2ubuntu1.11 Ubuntu 12.04 LTS: qemu-kvm 1.0+noroms-0ubuntu14.22 After a standard system update you need to restart all QEMU virtual machines to make all the necessary changes

Trust: 2.34

sources: NVD: CVE-2015-3456 // BID: 74640 // VULMON: CVE-2015-3456 // PACKETSTORM: 132057 // PACKETSTORM: 131887 // PACKETSTORM: 131920 // PACKETSTORM: 132009 // PACKETSTORM: 131894 // PACKETSTORM: 131912 // PACKETSTORM: 132205 // PACKETSTORM: 131889 // PACKETSTORM: 132083 // PACKETSTORM: 131892 // PACKETSTORM: 131879 // PACKETSTORM: 131899

AFFECTED PRODUCTS

vendor:xenmodel:xenscope:eqversion:4.5.0

Trust: 1.3

vendor:redhatmodel:openstackscope:eqversion:4.0

Trust: 1.3

vendor:redhatmodel:enterprise linuxscope:eqversion:7.0

Trust: 1.0

vendor:redhatmodel:openstackscope:eqversion:6.0

Trust: 1.0

vendor:redhatmodel:enterprise linuxscope:eqversion:6.0

Trust: 1.0

vendor:qemumodel:qemuscope:lteversion:2.3.0

Trust: 1.0

vendor:redhatmodel:openstackscope:eqversion:5.0

Trust: 1.0

vendor:redhatmodel:enterprise linuxscope:eqversion:5

Trust: 1.0

vendor:redhatmodel:enterprise virtualizationscope:eqversion:3.0

Trust: 1.0

vendor:redhatmodel:openstackscope:eqversion:7.0

Trust: 1.0

vendor:xenmodel:xenscope:eqversion:4.4.1

Trust: 0.3

vendor:xenmodel:rc1scope:eqversion:4.4.0

Trust: 0.3

vendor:xenmodel:xenscope:eqversion:4.4.0

Trust: 0.3

vendor:xenmodel:xenscope:eqversion:4.3.1

Trust: 0.3

vendor:xenmodel:xenscope:eqversion:4.3.0

Trust: 0.3

vendor:xenmodel:xenscope:eqversion:4.2.3

Trust: 0.3

vendor:xenmodel:xenscope:eqversion:4.2.2

Trust: 0.3

vendor:xenmodel:xenscope:eqversion:4.2.1

Trust: 0.3

vendor:xenmodel:xenscope:eqversion:4.2.0

Trust: 0.3

vendor:ubuntumodel:linuxscope:eqversion:15.04

Trust: 0.3

vendor:ubuntumodel:linuxscope:eqversion:14.10

Trust: 0.3

vendor:ubuntumodel:linux ltsscope:eqversion:14.04

Trust: 0.3

vendor:ubuntumodel:linux lts i386scope:eqversion:12.04

Trust: 0.3

vendor:ubuntumodel:linux lts amd64scope:eqversion:12.04

Trust: 0.3

vendor:susemodel:linux enterprise software development kit sp3scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp3scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp2scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp1scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp4 ltssscope:eqversion:10

Trust: 0.3

vendor:susemodel:linux enterprise server sp4scope:eqversion:10

Trust: 0.3

vendor:susemodel:linux enterprise server sp3scope:eqversion:10

Trust: 0.3

vendor:susemodel:linux enterprise software development kitscope:eqversion:12

Trust: 0.3

vendor:susemodel:linux enterprise serverscope:eqversion:12

Trust: 0.3

vendor:susemodel:linux enterprise server sp2 ltssscope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp1 ltssscope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise expanded supportscope:eqversion:7

Trust: 0.3

vendor:susemodel:linux enterprise expanded supportscope:eqversion:6

Trust: 0.3

vendor:susemodel:linux enterprise expanded supportscope:eqversion:5

Trust: 0.3

vendor:susemodel:linux enterprise desktopscope:eqversion:12

Trust: 0.3

vendor:susemodel:linux enterprise desktop sp3scope:eqversion:11

Trust: 0.3

vendor:s u s emodel:opensusescope:eqversion:13.2

Trust: 0.3

vendor:s u s emodel:opensusescope:eqversion:13.1

Trust: 0.3

vendor:redhatmodel:openstack for rhelscope:eqversion:6.07

Trust: 0.3

vendor:redhatmodel:openstack for rhelscope:eqversion:5.07

Trust: 0.3

vendor:redhatmodel:openstack for rhelscope:eqversion:5.06

Trust: 0.3

vendor:redhatmodel:enterprise virtualizationscope:eqversion:3

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux virtualization serverscope:eqversion:5

Trust: 0.3

vendor:redhatmodel:enterprise linux server eus 6.5.zscope: - version: -

Trust: 0.3

vendor:redhatmodel:enterprise linux server ausscope:eqversion:6.5

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop multi os clientscope:eqversion:5

Trust: 0.3

vendor:redhatmodel:enterprise linux desktopscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linux desktopscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop clientscope:eqversion:5

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:5

Trust: 0.3

vendor:qemumodel:qemuscope:eqversion:0

Trust: 0.3

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.54

Trust: 0.3

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.53

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:7

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6.2

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:junipermodel:northstar controller applicationscope:eqversion:2.1.0

Trust: 0.3

vendor:joyentmodel:smartdatacenterscope:eqversion:0

Trust: 0.3

vendor:joyentmodel:public cloudscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:pureapplication systemscope:eqversion:2.1

Trust: 0.3

vendor:ibmmodel:pureapplication systemscope:eqversion:2.0

Trust: 0.3

vendor:ibmmodel:powerkvmscope:eqversion:2.1

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.20

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.3.0

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.1.0

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.0.1

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.0.0

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.2.1.0

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.2.0.0

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.1.0.0

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r005c10scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r005c00spc300scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r005c00scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r003c10spc600scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r003c10cp6001scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r003c10scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r003c00spc300scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r003c00scope: - version: -

Trust: 0.3

vendor:hpmodel:helion openstackscope:eqversion:1.1.0

Trust: 0.3

vendor:hpmodel:helion openstackscope:eqversion:1.0.0

Trust: 0.3

vendor:hpmodel:helion cloudsystemscope:eqversion:8.1

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:fortinetmodel:fortisandboxscope:eqversion:2.0.2

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:citrixmodel:xenserverscope:eqversion:6.0.2

Trust: 0.3

vendor:citrixmodel:xenserverscope:eqversion:6.5

Trust: 0.3

vendor:citrixmodel:xenserverscope:eqversion:6.2

Trust: 0.3

vendor:citrixmodel:xenserverscope:eqversion:6.1

Trust: 0.3

vendor:citrixmodel:xenserverscope:eqversion:6.0

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:7

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:6

Trust: 0.3

vendor:centosmodel:centosscope:eqversion:5

Trust: 0.3

vendor:junipermodel:northstar controller application service packscope:neversion:2.1.01

Trust: 0.3

vendor:huaweimodel:fusioncompute v100r005c00cp3001scope:neversion: -

Trust: 0.3

vendor:fortinetmodel:fortisandboxscope:neversion:2.0.3

Trust: 0.3

sources: BID: 74640 // NVD: CVE-2015-3456

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-3456
value: HIGH

Trust: 1.0

VULMON: CVE-2015-3456
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-3456
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

sources: VULMON: CVE-2015-3456 // NVD: CVE-2015-3456

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

sources: NVD: CVE-2015-3456

THREAT TYPE

network

Trust: 0.3

sources: BID: 74640

TYPE

arbitrary

Trust: 0.9

sources: PACKETSTORM: 132057 // PACKETSTORM: 131887 // PACKETSTORM: 132009 // PACKETSTORM: 131894 // PACKETSTORM: 131912 // PACKETSTORM: 132205 // PACKETSTORM: 131889 // PACKETSTORM: 131892 // PACKETSTORM: 131899

EXPLOIT AVAILABILITY

[
  {
    "type": "exploit",
    "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=37053",
    "trust": 0.1
  }
]

sources: VULMON: CVE-2015-3456

PATCH

title:The Registerurl:https://www.theregister.co.uk/2016/05/05/poc_exploit_tripled_2015_study/

Trust: 0.2

title:The Registerurl:https://www.theregister.co.uk/2015/05/19/oracle_patches_venom/

Trust: 0.2

title:The Registerurl:https://www.theregister.co.uk/2015/05/14/venom_analysis/

Trust: 0.2

title:Debian CVElist Bug Report Logs: virtualbox: CVE-2015-3456: floppy driver host code executionurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=1e9cefc84b9a72ae90225e9ff55d95b7

Trust: 0.1

title:Debian Security Advisories: DSA-3262-1 xen -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=062e555c99e007ed070757c824f250eb

Trust: 0.1

title:Debian Security Advisories: DSA-3274-1 virtualbox -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=13673fabccef0c794fd2bc2944597470

Trust: 0.1

title:Ubuntu Security Notice: qemu, qemu-kvm vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2608-1

Trust: 0.1

title:Debian Security Advisories: DSA-3259-1 qemu -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=57edcd554beef990c5db7c77e4410e91

Trust: 0.1

title:Debian CVElist Bug Report Logs: qemu: CVE-2014-9718 CVE-2015-1779url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=a8c61c5fbe108faa83788a9a61ccb677

Trust: 0.1

title:Symantec Security Advisories: SA95 : VENOM Vulnerability in Virtualization Platformsurl:https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories&qid=015b922e5570d0f4c9f66b103d8e694a

Trust: 0.1

title:Oracle: Oracle Security Alert for CVE-2015-3456url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=222bdb74a04df3dae048eda54c80f9ea

Trust: 0.1

title:Oracle: Oracle Critical Patch Update Advisory - July 2015url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=459961024c4bdce7bb3a1a40a65a6f2e

Trust: 0.1

title:elysiumVMurl:https://github.com/cyberlifetech/elysiumVM

Trust: 0.1

title:cve-2015-3456url:https://github.com/vincentbernat/cve-2015-3456

Trust: 0.1

title: - url:https://github.com/RUB-SysSec/Hypercube

Trust: 0.1

title:laputaurl:https://github.com/takuzoo3868/laputa

Trust: 0.1

title:cookbook-xs-maintenanceurl:https://github.com/pigram86/cookbook-xs-maintenance

Trust: 0.1

title:rhsecapiurl:https://github.com/RedHatOfficial/rhsecapi

Trust: 0.1

title:cve-pyliburl:https://github.com/RedHatProductSecurity/cve-pylib

Trust: 0.1

sources: VULMON: CVE-2015-3456

EXTERNAL IDS

db:NVDid:CVE-2015-3456

Trust: 2.6

db:BIDid:74640

Trust: 1.4

db:JUNIPERid:JSA10783

Trust: 1.4

db:SECTRACKid:1032917

Trust: 1.1

db:SECTRACKid:1032306

Trust: 1.1

db:SECTRACKid:1032311

Trust: 1.1

db:EXPLOIT-DBid:37053

Trust: 1.1

db:JUNIPERid:JSA10693

Trust: 1.1

db:MCAFEEid:SB10118

Trust: 1.1

db:VULMONid:CVE-2015-3456

Trust: 0.1

db:PACKETSTORMid:132057

Trust: 0.1

db:PACKETSTORMid:131887

Trust: 0.1

db:PACKETSTORMid:131920

Trust: 0.1

db:PACKETSTORMid:132009

Trust: 0.1

db:PACKETSTORMid:131894

Trust: 0.1

db:PACKETSTORMid:131912

Trust: 0.1

db:PACKETSTORMid:132205

Trust: 0.1

db:PACKETSTORMid:131889

Trust: 0.1

db:PACKETSTORMid:132083

Trust: 0.1

db:PACKETSTORMid:131892

Trust: 0.1

db:PACKETSTORMid:131879

Trust: 0.1

db:PACKETSTORMid:131899

Trust: 0.1

sources: VULMON: CVE-2015-3456 // BID: 74640 // PACKETSTORM: 132057 // PACKETSTORM: 131887 // PACKETSTORM: 131920 // PACKETSTORM: 132009 // PACKETSTORM: 131894 // PACKETSTORM: 131912 // PACKETSTORM: 132205 // PACKETSTORM: 131889 // PACKETSTORM: 132083 // PACKETSTORM: 131892 // PACKETSTORM: 131879 // PACKETSTORM: 131899 // NVD: CVE-2015-3456

REFERENCES

url:http://rhn.redhat.com/errata/rhsa-2015-0999.html

Trust: 1.5

url:http://rhn.redhat.com/errata/rhsa-2015-1004.html

Trust: 1.5

url:http://rhn.redhat.com/errata/rhsa-2015-1011.html

Trust: 1.5

url:http://rhn.redhat.com/errata/rhsa-2015-1000.html

Trust: 1.4

url:http://xenbits.xen.org/xsa/advisory-133.html

Trust: 1.4

url:http://rhn.redhat.com/errata/rhsa-2015-1001.html

Trust: 1.4

url:https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/

Trust: 1.4

url:http://venom.crowdstrike.com/

Trust: 1.4

url:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Trust: 1.4

url:http://support.citrix.com/article/ctx201078

Trust: 1.4

url:http://rhn.redhat.com/errata/rhsa-2015-0998.html

Trust: 1.2

url:https://access.redhat.com/articles/1444903

Trust: 1.2

url:http://rhn.redhat.com/errata/rhsa-2015-1003.html

Trust: 1.2

url:http://www.ubuntu.com/usn/usn-2608-1

Trust: 1.2

url:https://www.exploit-db.com/exploits/37053/

Trust: 1.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-3456

Trust: 1.2

url:http://rhn.redhat.com/errata/rhsa-2015-1002.html

Trust: 1.1

url:https://www.suse.com/security/cve/cve-2015-3456.html

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html

Trust: 1.1

url:http://www.debian.org/security/2015/dsa-3274

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=143229451215900&w=2

Trust: 1.1

url:http://www.securityfocus.com/bid/74640

Trust: 1.1

url:https://kc.mcafee.com/corporate/index?page=content&id=sb10118

Trust: 1.1

url:http://lists.fedoraproject.org/pipermail/package-announce/2015-may/158072.html

Trust: 1.1

url:http://www.debian.org/security/2015/dsa-3259

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html

Trust: 1.1

url:https://support.lenovo.com/us/en/product_security/venom

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=143387998230996&w=2

Trust: 1.1

url:http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm

Trust: 1.1

url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10693

Trust: 1.1

url:https://bto.bluecoat.com/security-advisory/sa95

Trust: 1.1

url:http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability

Trust: 1.1

url:http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html

Trust: 1.1

url:http://www.securitytracker.com/id/1032311

Trust: 1.1

url:http://www.securitytracker.com/id/1032306

Trust: 1.1

url:http://www.debian.org/security/2015/dsa-3262

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html

Trust: 1.1

url:https://kb.juniper.net/jsa10783

Trust: 1.1

url:https://security.gentoo.org/glsa/201612-27

Trust: 1.1

url:https://security.gentoo.org/glsa/201604-03

Trust: 1.1

url:https://security.gentoo.org/glsa/201602-01

Trust: 1.1

url:http://www.securitytracker.com/id/1032917

Trust: 1.1

url:https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10

Trust: 1.1

url:http://git.qemu.org/?p=qemu.git%3ba=commitdiff%3bh=e907746266721f305d67bc0718795fedee2e824c

Trust: 1.0

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.6

url:https://access.redhat.com/articles/11258

Trust: 0.6

url:https://bugzilla.redhat.com/):

Trust: 0.6

url:https://access.redhat.com/security/team/key/

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2015-3456

Trust: 0.6

url:https://access.redhat.com/security/team/contact/

Trust: 0.6

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.6

url:http://www.debian.org/security/

Trust: 0.6

url:https://rhn.redhat.com/errata/rhsa-2015-1031.html

Trust: 0.4

url:http://git.qemu.org/?p=qemu.git;a=commit;h=e907746266721f305d67bc0718795fedee2e824c

Trust: 0.3

url:http://wiki.qemu.org/main_page

Trust: 0.3

url:https://kb.juniper.net/infocenter/index?page=content&id=jsa10783&cat=sirt_1&actp=list

Trust: 0.3

url:http://www.fortiguard.com/advisory/fg-ir-15-012/

Trust: 0.3

url:http://seclists.org/bugtraq/2015/may/129

Trust: 0.3

url:https://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04706564

Trust: 0.3

url:https://www.suse.com/support/kb/doc.php?id=7016497

Trust: 0.3

url:http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-438937.htm

Trust: 0.3

url:https://help.joyent.com/entries/68099220-security-advisory-on-venom-cve-2015-3456-in-kvm-qemu

Trust: 0.3

url:https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5098681

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21903743

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=isg3t1022292

Trust: 0.3

url:http://www.huawei.com/en/security/psirt/security-bulletins/security-notices/archive/hw-428704.htm

Trust: 0.3

url:https://www.suse.com/support/update/announcement/2015/suse-su-20150889-1.html

Trust: 0.3

url:https://www.suse.com/support/update/announcement/2015/suse-su-20150943-1.html

Trust: 0.3

url:https://www.suse.com/support/update/announcement/2015/suse-su-20150896-1.html

Trust: 0.3

url:https://www.suse.com/support/update/announcement/2015/suse-su-20150889-2.html

Trust: 0.3

url:https://www.suse.com/support/update/announcement/2015/suse-su-20150944-1.html

Trust: 0.3

url:https://www-304.ibm.com/connections/blogs/psirt/entry/venom_cve_2015_3456?lang=en_us

Trust: 0.3

url:http://www.debian.org/security/faq

Trust: 0.3

url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/

Trust: 0.2

url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-1779

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2756

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/119.html

Trust: 0.1

url:http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c

Trust: 0.1

url:https://github.com/cyberlifetech/elysiumvm

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:http://tools.cisco.com/security/center/viewalert.x?alertid=38855

Trust: 0.1

url:https://usn.ubuntu.com/2608-1/

Trust: 0.1

url:https://helion.hpwsportal.com

Trust: 0.1

url:http://docs.hpcloud.com/helion/openstack/1.1.1/update

Trust: 0.1

url:http://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay/?doci

Trust: 0.1

url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9718

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.11

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/qemu/2.1+dfsg-4ubuntu6.6

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.22

Trust: 0.1

sources: VULMON: CVE-2015-3456 // BID: 74640 // PACKETSTORM: 132057 // PACKETSTORM: 131887 // PACKETSTORM: 131920 // PACKETSTORM: 132009 // PACKETSTORM: 131894 // PACKETSTORM: 131912 // PACKETSTORM: 132205 // PACKETSTORM: 131889 // PACKETSTORM: 132083 // PACKETSTORM: 131892 // PACKETSTORM: 131879 // PACKETSTORM: 131899 // NVD: CVE-2015-3456

CREDITS

Red Hat

Trust: 0.6

sources: PACKETSTORM: 132057 // PACKETSTORM: 131887 // PACKETSTORM: 131894 // PACKETSTORM: 131912 // PACKETSTORM: 131889 // PACKETSTORM: 131892

SOURCES

db:VULMONid:CVE-2015-3456
db:BIDid:74640
db:PACKETSTORMid:132057
db:PACKETSTORMid:131887
db:PACKETSTORMid:131920
db:PACKETSTORMid:132009
db:PACKETSTORMid:131894
db:PACKETSTORMid:131912
db:PACKETSTORMid:132205
db:PACKETSTORMid:131889
db:PACKETSTORMid:132083
db:PACKETSTORMid:131892
db:PACKETSTORMid:131879
db:PACKETSTORMid:131899
db:NVDid:CVE-2015-3456

LAST UPDATE DATE

2025-05-03T21:51:12.723000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2015-3456date:2021-11-17T00:00:00
db:BIDid:74640date:2017-04-18T00:05:00
db:NVDid:CVE-2015-3456date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:VULMONid:CVE-2015-3456date:2015-05-13T00:00:00
db:BIDid:74640date:2015-05-13T00:00:00
db:PACKETSTORMid:132057date:2015-05-28T05:28:18
db:PACKETSTORMid:131887date:2015-05-13T19:44:44
db:PACKETSTORMid:131920date:2015-05-19T14:48:58
db:PACKETSTORMid:132009date:2015-05-22T13:33:33
db:PACKETSTORMid:131894date:2015-05-13T19:45:39
db:PACKETSTORMid:131912date:2015-05-17T02:42:42
db:PACKETSTORMid:132205date:2015-06-10T01:23:25
db:PACKETSTORMid:131889date:2015-05-13T19:44:59
db:PACKETSTORMid:132083date:2015-05-29T23:37:29
db:PACKETSTORMid:131892date:2015-05-13T19:45:24
db:PACKETSTORMid:131879date:2015-05-13T17:43:32
db:PACKETSTORMid:131899date:2015-05-13T19:17:35
db:NVDid:CVE-2015-3456date:2015-05-13T18:59:00.157