=========================================================== Ubuntu Security Notice USN-1063-1 February 14, 2011 qemu-kvm vulnerability CVE-2011-0011 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.10 Ubuntu 10.04 LTS Ubuntu 10.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.10: kvm 0.11.0-0ubuntu6.4 qemu 0.11.0-0ubuntu6.4 qemu-arm-static 0.11.0-0ubuntu6.4 qemu-kvm 0.11.0-0ubuntu6.4 qemu-kvm-extras 0.11.0-0ubuntu6.4 Ubuntu 10.04 LTS: kvm 0.12.3+noroms-0ubuntu9.4 qemu 0.12.3+noroms-0ubuntu9.4 qemu-arm-static 0.12.3+noroms-0ubuntu9.4 qemu-common 0.12.3+noroms-0ubuntu9.4 qemu-kvm 0.12.3+noroms-0ubuntu9.4 qemu-kvm-extras 0.12.3+noroms-0ubuntu9.4 qemu-kvm-extras-static 0.12.3+noroms-0ubuntu9.4 Ubuntu 10.10: kvm 0.12.5+noroms-0ubuntu7.2 qemu 0.12.5+noroms-0ubuntu7.2 qemu-arm-static 0.12.5+noroms-0ubuntu7.2 qemu-kvm 0.12.5+noroms-0ubuntu7.2 qemu-kvm-extras 0.12.5+noroms-0ubuntu7.2 qemu-kvm-extras-static 0.12.5+noroms-0ubuntu7.2 After a standard system update you need to restart any running QEMU sessions to make all the necessary changes. Details follow: Neil Wilson discovered that if VNC passwords were blank in QEMU configurations, access to VNC sessions was allowed without a password instead of being disabled. A remote attacker could connect to running VNC sessions of QEMU and directly control the system. By default, QEMU does not start VNC sessions. Updated packages for Ubuntu 9.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.4.diff.gz Size/MD5: 49951 b1eb8586a033e224d929ffee2f372e7b http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.4.dsc Size/MD5: 2056 ce3fa0319c9d0c0f07c5264d1c89f4aa http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0.orig.tar.gz Size/MD5: 4382897 440837a062967102a68e634d57eaf719 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.4_amd64.deb Size/MD5: 9268 77a356214c0573a0cad03a590f3abc39 http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.4_amd64.deb Size/MD5: 2813560 3917642c38b4e4eb87c34c2defaba0a6 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.4_amd64.deb Size/MD5: 636276 35dcc645220981dd2b21d4b6f6fcfe98 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.4_amd64.deb Size/MD5: 15469464 0e0cf0c3cb235b03dfe2f871935fc24d http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.4_amd64.deb Size/MD5: 8724 d5ce47a96404c1bc774f0381871a73d3 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.4_i386.deb Size/MD5: 9264 e7fd0bb4ffc6ee6a0af381963dc38db7 http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.4_i386.deb Size/MD5: 2592266 0d0574ef0726f86b9a9c0c0ee825a4b7 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.4_i386.deb Size/MD5: 558988 bb3e361f0b739fa47e23348eea83c0b2 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.4_i386.deb Size/MD5: 13984592 4a5bad4d141286b9730aee17e8e7f601 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.4_i386.deb Size/MD5: 8726 e6118d53d74abca674bf097d368da333 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.11.0+0ubuntu6.4_lpia.deb Size/MD5: 9266 c6876667f4913ed354cf856208357d5c http://ports.ubuntu.com/pool/main/q/qemu-kvm/qemu-kvm_0.11.0-0ubuntu6.4_lpia.deb Size/MD5: 2621292 7c38852bf5ae9f51a5b72ab419162c44 http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-arm-static_0.11.0-0ubuntu6.4_lpia.deb Size/MD5: 578778 a2ab4d647e97f543b54bda1914eb3456 http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.11.0-0ubuntu6.4_lpia.deb Size/MD5: 14110322 cae30bd890e32b1dad2c12be0063d429 http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.11.0-0ubuntu6.4_lpia.deb Size/MD5: 8720 effdfd7814e75becc5317f30624f3131 Updated packages for Ubuntu 10.04 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.3+noroms-0ubuntu9.4.diff.gz Size/MD5: 59055 ddd620576dad48286d6844784606f663 http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.3+noroms-0ubuntu9.4.dsc Size/MD5: 2195 0cfe7be7ae0d42394c7faa4d7b14cd4d http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.3+noroms.orig.tar.gz Size/MD5: 3855993 3d06a46426bf2e9d13c271532e128155 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-common_0.12.3+noroms-0ubuntu9.4_all.deb Size/MD5: 29614 db3d44856d4abca79224bc3c75d8a107 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_amd64.deb Size/MD5: 14688 c6b47811b8500acd877067d46ccea77c http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.3+noroms-0ubuntu9.4_amd64.deb Size/MD5: 2952078 13d4bfa4883e4868222b46cec34cdbf3 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.12.3+noroms-0ubuntu9.4_amd64.deb Size/MD5: 14234 a0fd5588781d377a701224241bedde0a http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras-static_0.12.3+noroms-0ubuntu9.4_amd64.deb Size/MD5: 11183532 de3f7e009353e6f0eca9bba6c745afa2 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_amd64.deb Size/MD5: 16943070 056670a82ab408912444af029156df9e http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.12.3+noroms-0ubuntu9.4_amd64.deb Size/MD5: 14082 a85a7e312b308bd60041aec0a6aaab0e i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_i386.deb Size/MD5: 14690 ed7b59c87f0a24390c250ceaaff57587 http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.3+noroms-0ubuntu9.4_i386.deb Size/MD5: 2557370 cbff84fc36b0af7ad84ed6945fd4270f http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.12.3+noroms-0ubuntu9.4_i386.deb Size/MD5: 14236 b8951772f70aa22d0a9a81a2a4102f91 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras-static_0.12.3+noroms-0ubuntu9.4_i386.deb Size/MD5: 8926712 40f7dd7ec241ce0521442839e29f7098 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_i386.deb Size/MD5: 14483128 667bfa9b046cba5470961abe0222b8b6 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.12.3+noroms-0ubuntu9.4_i386.deb Size/MD5: 14074 0491a031d555399f5a67a2b8f1d1fb27 armel architecture (ARM Architecture): http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_armel.deb Size/MD5: 14696 ba439027498f93ef1f0de2b80e932137 http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_armel.deb Size/MD5: 15352518 f23a678eecc1046f83d7d48ef419aa7f http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.12.3+noroms-0ubuntu9.4_armel.deb Size/MD5: 14084 4beb4cd934c0a504a29b84fd5e8cc56d powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_powerpc.deb Size/MD5: 14690 ec59a9867512187e7c25d942b315e498 http://ports.ubuntu.com/pool/main/q/qemu-kvm/qemu-kvm_0.12.3+noroms-0ubuntu9.4_powerpc.deb Size/MD5: 2878074 eb7f446a8fc88686e60cdc4622a60596 http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.3+noroms-0ubuntu9.4_powerpc.deb Size/MD5: 16044010 e35c6be48ca03d4c73abb8f47c2782ba http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.12.3+noroms-0ubuntu9.4_powerpc.deb Size/MD5: 14078 44aaec5fe491fd6028b257b8c4b44553 sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.3+noroms+0ubuntu9.4_sparc.deb Size/MD5: 42850 5e211af4450bba271debdc8539451c31 http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.12.3+noroms-0ubuntu9.4_sparc.deb Size/MD5: 14074 bebc621f4091c9a35dbc0f6b68a25983 Updated packages for Ubuntu 10.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.5+noroms-0ubuntu7.2.diff.gz Size/MD5: 59296 62995fbdb4c625defd2e4f2f7cc97b14 http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.5+noroms-0ubuntu7.2.dsc Size/MD5: 2221 3d97883f347516f5aefc59fa96919569 http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.5+noroms.orig.tar.gz Size/MD5: 4722351 c7303c30432dc4eb0a39bb85a9d15cc9 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-common_0.12.5+noroms-0ubuntu7.2_all.deb Size/MD5: 31566 a3de989fa047a4267df2aea092e8c009 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_amd64.deb Size/MD5: 16050 3862d4b962732b539d8b25b069e156ee http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.5+noroms-0ubuntu7.2_amd64.deb Size/MD5: 2957096 69bc0a937f2e04ca32c09732dc191453 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.12.5+noroms-0ubuntu7.2_amd64.deb Size/MD5: 15680 5dad6903eb7aa01d25360170306ab330 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras-static_0.12.5+noroms-0ubuntu7.2_amd64.deb Size/MD5: 11168302 91bc79c088eaad99c7a49383893c2fdc http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_amd64.deb Size/MD5: 16957714 ff9c39105e09c6a4102c3cf3dbf3107a http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.12.5+noroms-0ubuntu7.2_amd64.deb Size/MD5: 15524 8273e72ea1150187c776c8dac8ed2488 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_i386.deb Size/MD5: 16044 9c3462e5d6a0755d3fa69ca11d933aef http://security.ubuntu.com/ubuntu/pool/main/q/qemu-kvm/qemu-kvm_0.12.5+noroms-0ubuntu7.2_i386.deb Size/MD5: 2564790 ada35e13122697d5fea9773639654024 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-arm-static_0.12.5+noroms-0ubuntu7.2_i386.deb Size/MD5: 15682 b242ac1ce847b1d6d63e8539b41a176a http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras-static_0.12.5+noroms-0ubuntu7.2_i386.deb Size/MD5: 9135998 b65dfb9ef035cc01c071205c1ec6e5ec http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_i386.deb Size/MD5: 14505730 0ed7b21c70261300999943ca3bcf1816 http://security.ubuntu.com/ubuntu/pool/universe/q/qemu-kvm/qemu_0.12.5+noroms-0ubuntu7.2_i386.deb Size/MD5: 15526 b535c8f8e4b401fe0bbbf8a8d9d6217b armel architecture (ARM Architecture): http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_armel.deb Size/MD5: 16052 e2216cd3d34a0c0e3a26e1043f394576 http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_armel.deb Size/MD5: 16686058 ef388115c1a3f3a2c6c9dffd2c81effc http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.12.5+noroms-0ubuntu7.2_armel.deb Size/MD5: 15528 fb3afeddcfa09f079fb898959ac6c3b5 powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/q/qemu-kvm/kvm_84+dfsg-0ubuntu16+0.12.5+noroms+0ubuntu7.2_powerpc.deb Size/MD5: 16050 ab495cfe0e2c0fd319eba2b8a3e9ff64 http://ports.ubuntu.com/pool/main/q/qemu-kvm/qemu-kvm_0.12.5+noroms-0ubuntu7.2_powerpc.deb Size/MD5: 2887434 4a636ec1c5a06cbf729d2213291aa2ee http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu-kvm-extras_0.12.5+noroms-0ubuntu7.2_powerpc.deb Size/MD5: 16064224 3f0f63526a0215877b3c619bbdea0ffe http://ports.ubuntu.com/pool/universe/q/qemu-kvm/qemu_0.12.5+noroms-0ubuntu7.2_powerpc.deb Size/MD5: 15528 d930a7237b7efe1d7a7c10d755ab1ded