libvirt 'VirDomainGetVcpus()' Function Remote Integer Overflow Heap Corruption Vulnerability

http://www.securityfocus.com/bid/48478

Security Info

Bugtraq ID:	48478
Class:	Boundary Condition Error
CVE:	CVE-2011-2511
Remote:	Yes
Local:	No
Published:	Jun 24 2011 12:00AM
Updated:	Feb 28 2012 06:30PM
Credit:	Eric Blake
Vulnerable:	Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 RedHat Enterprise Linux Virtualization 5 server RedHat Enterprise Linux Desktop Multi OS 5 client Red Hat Fedora 15 Red Hat Fedora 14 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 libvirt libvirt 0.9.2 libvirt libvirt 0 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.1

Not Vulnerable:	libvirt libvirt 0.9.3

Security Discussion

libvirt is prone to a remote heap-based memory-corruption vulnerability because of an integer-overflow error.

Successfully exploiting this issue allows remote attackers to crash the 'libvirtd' daemon in the application that uses the affected library, denying service to legitimate users. Due to the nature of this issue, code execution may be possible; however, this has not been confirmed.

Proof of Concept and Security Exploits

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.com.

Security Solution(s)

Solution:
Updates are available. Please see the references for more information.

Security References(s)

References:

[libvirt] [PATCH 2/2] remote: protect against integer overflow (Eric Blake )
libvirt Homepage (libvirt )
ASA-2011-240 libvirt security, bug fix, and enhancement update (RHSA-2011-1019) (Avaya)
Red Hat Security Advisory RHSA-2011:1019-1 (Red Hat )

Emagined Security Blog featuring Dr. Eugene Schultz

Secure Web Programming
by Vizual Services