CVE-2008-1945: Low severity qemu vulnerability

Published Aug 8, 2008

Updated

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

Affected Software

14 affected components

Qemu Qemu=0.9.0

openSUSE openSUSE=11.1

openSUSE openSUSE=11.0

openSUSE openSUSE=10.3

SUSE Linux Enterprise Server=11

SUSE Linux Enterprise Server=10

Debian Debian Linux=5.0

Debian Debian Linux=4.0

Canonical Ubuntu Linux=8.10

Canonical Ubuntu Linux=8.04

redhat Enterprise Linux Server=5.0

redhat Enterprise Linux Workstation=5.0

redhat Enterprise Linux Desktop=5.0

redhat Enterprise Linux Eus=5.2

Event History

Aug 8, 2008

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1945?

CVE-2008-1945 is considered a high severity vulnerability as it allows guest OS users to read arbitrary files on the host OS.

How do I fix CVE-2008-1945?

To fix CVE-2008-1945, upgrade QEMU to a version that has addressed this vulnerability.

Which versions of QEMU are affected by CVE-2008-1945?

CVE-2008-1945 specifically affects QEMU version 0.9.0.

What types of systems are vulnerable to CVE-2008-1945?

Systems running QEMU 0.9.0 on various distributions like openSUSE, Debian, Ubuntu, and Red Hat are vulnerable to CVE-2008-1945.

What is the impact of exploiting CVE-2008-1945?

Exploiting CVE-2008-1945 allows an attacker to access files on the host operating system from a guest OS, leading to potential data exposure.