Scientific Linux 6.x: Moderate Qemu-Kvm Update For Authentication Issue

Date: Fri, 11 Mar 2011 09:35:10 -0600
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Moderate: qemu-kvm on SL6.x x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Moderate: qemu-kvm security update
Issue date:	2011-03-10
CVE Names:	CVE-2011-0011

A flaw was found in the way the VNC "password" option was handled.
Clearingaa password disabled VNC authentication, allowing a remote user
able to connect to the virtual machines' VNC ports to open a VNC session
without authentication. (CVE-2011-0011)

After installing this update, shut down all running virtual machines.
Once all virtual machines have shut down, start them again for this
update to take effect.

SL 6.x

 SRPMS:
qemu-kvm-0.12.1.2-2.113.el6_0.8.src.rpm
 x86_64:
qemu-img-0.12.1.2-2.113.el6_0.8.x86_64.rpm
qemu-kvm-0.12.1.2-2.113.el6_0.8.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.113.el6_0.8.x86_64.rpm

-Connie Sieh
-Troy Dawson