CVE-2013-6434

Published: 24 January 2014

The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.

Notes

Insufficient details were provided to determine where the fault
is -- the Red Hat update is to their rhevm package -- so I've marked spice
as the involved package until this can be researched further.

possibly https://github.com/oVirt/ovirt-engine/commit/f39cf23b6fedc924d054e3178242388e52a3c7ed
likely rhevm specific

Status

References

• https://rhn.redhat.com/errata/RHSA-2014-0038.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6434
• https://www.cve.org/CVERecord?id=CVE-2013-6434
• NVD
• Launchpad
• Debian