USN-1063-1: QEMU vulnerability

Releases

• Ubuntu 10.10
• Ubuntu 10.04
• Ubuntu 9.10

Packages

• qemu-kvm - Full virtualization on i386 and amd64 hardware

Details

Neil Wilson discovered that if VNC passwords were blank in QEMU
configurations, access to VNC sessions was allowed without a password
instead of being disabled. A remote attacker could connect to running
VNC sessions of QEMU and directly control the system. By default, QEMU
does not start VNC sessions.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• qemu-kvm - 0.11.0-0ubuntu6.4
• qemu-arm-static - 0.11.0-0ubuntu6.4
• kvm - 0.11.0-0ubuntu6.4
• qemu - 0.11.0-0ubuntu6.4
• qemu-kvm-extras - 0.11.0-0ubuntu6.4

Ubuntu 10.10

• qemu-kvm - 0.12.5+noroms-0ubuntu7.2
• qemu-kvm-extras-static - 0.12.5+noroms-0ubuntu7.2
• kvm - 0.12.5+noroms-0ubuntu7.2
• qemu-arm-static - 0.12.5+noroms-0ubuntu7.2
• qemu-kvm-extras - 0.12.5+noroms-0ubuntu7.2
• qemu - 0.12.5+noroms-0ubuntu7.2

Ubuntu 10.04

• qemu-kvm - 0.12.3+noroms-0ubuntu9.4
• qemu-kvm-extras - 0.12.3+noroms-0ubuntu9.4
• kvm - 0.12.3+noroms-0ubuntu9.4
• qemu-arm-static - 0.12.3+noroms-0ubuntu9.4
• qemu-kvm-extras-static - 0.12.3+noroms-0ubuntu9.4
• qemu-common - 0.12.3+noroms-0ubuntu9.4
• qemu - 0.12.3+noroms-0ubuntu9.4

After a standard system update you need to restart any running QEMU sessions
to make all the necessary changes.

References

• CVE-2011-0011