National Cyber Awareness System

Vulnerability Summary for CVE-2007-5729

Overview

The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (11/02/2007)

Not vulnerable. This issue did not affect Xen as shipped with Red Hat Enterprise Linux 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2007-1597

Hyperlink:http://www.vupen.com/english/advisories/2007/1597

External Source: MANDRIVA

Name: MDVSA-2008:162

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:162

External Source: DEBIAN

Name: DSA-1284

Hyperlink:http://www.debian.org/security/2007/dsa-1284

External Source: MISC

Name: http://taviso.decsystem.org/virtsec.pdf

Hyperlink:http://taviso.decsystem.org/virtsec.pdf

External Source: SECUNIA

Name: 33568

Hyperlink:http://secunia.com/advisories/33568

External Source: SECUNIA

Name: 29129

Hyperlink:http://secunia.com/advisories/29129

External Source: OSVDB

Name: 42986

Hyperlink:http://osvdb.org/42986

External Source: SUSE

Name: SUSE-SR:2009:002

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html

External Source: XF

Name: qemu-ne2000-code-execution(38238)

Hyperlink:http://xforce.iss.net/xforce/xfdb/38238

External Source: BID

Name: 23731

Hyperlink:http://www.securityfocus.com/bid/23731

External Source: MANDRIVA

Name: MDKSA-2007:203

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:203

External Source: VIM

Name: 20071030 Clarification on old QEMU/NE2000/Xen issues

Hyperlink:http://www.attrition.org/pipermail/vim/2007-October/001842.html

External Source: SECUNIA

Name: 27486

Hyperlink:http://secunia.com/advisories/27486

External Source: SECUNIA

Name: 25095

Hyperlink:http://secunia.com/advisories/25095

External Source: SECUNIA

Name: 25073

Hyperlink:http://secunia.com/advisories/25073