----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

Join the FREE BETA test of the Network Software Inspector (NSI)!
http://secunia.com/network_software_inspector/

The NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
QEMU Various Vulnerabilities

SECUNIA ADVISORY ID:
SA25073

VERIFY ADVISORY:
http://secunia.com/advisories/25073/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, DoS

WHERE:
Local system

SOFTWARE:
QEMU 0.x
http://secunia.com/product/14104/

DESCRIPTION:
Tavis Ormandy has reported some vulnerabilities in QEMU, which can be
exploited by malicious uses to bypass certain security restrictions or
cause a DoS (Denial of Service).

1) A boundary error exists within the "cirrus_invalidate_region()"
function of the Cirrus video driver, which can be exploited to cause
a heap-based buffer overflow.

2) The size of ethernet frames is not correctly checked against the
"MTU" before being copied into the registers of the NE2000 network
driver. This can be exploited to cause a heap-based buffer overflow.

3) An integer signedness error when processing data in the NE2000
device registers can be exploited to cause a heap-based buffer
overflow.

Successful exploitation of 1) through 3) may allow the execution of
arbitrary code.

4) Errors when handling the "icebp" instruction can be exploited to
cause a DoS by terminating the emulation session.

5) An error within the handling of the "aam" instruction can result
in a division by zero, which can be exploited to cause a DoS. 

Other issues, like an infinite loop in the SB16 driver, the
dereference of an uninitialised function in the DMA handling,
signedness errors in the IDE handling, and panics in the BIOS and VGA
BIOS have also been reported.

SOLUTION:
Do not run untrusted applications in an emulated environment.

PROVIDED AND/OR DISCOVERED BY:
Tavis Ormandy, Google

ORIGINAL ADVISORY:
http://taviso.decsystem.org/virtsec.pdf

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------