RHSA-2010:0476: Important: rhev-hypervisor security, bug fix, and enhancement update

The rhev-hypervisor package provides a Red Hat Enterprise VirtualizationHypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisoris a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includeseverything necessary to run and manage virtual machines: A subset of theRed Hat Enterprise Linux operating environment and the Red Hat EnterpriseVirtualization Agent.Note: Red Hat Enterprise Virtualization Hypervisor is only available forthe Intel 64 and AMD64 architectures with virtualization extensions.A flaw was found in the way QEMU-KVM handled erroneous data provided by theLinux virtio-net driver, used by guest operating systems. Due to adeficiency in the TSO (TCP segment offloading) implementation, a guest'svirtio-net driver would transmit improper data to a certain QEMU-KVMprocess on the host, causing the guest to crash. A remote attacker coulduse this flaw to send specially-crafted data to a target guest system,causing that guest to crash. (CVE-2010-0741)A flaw was found in the way the Virtual Desktop Server Manager (VDSM)handled the removal of a virtual machine's (VM) data back end (such as animage or a volume). When removing an image or a volume, it was not securelydeleted from its corresponding data domain as expected. A guest user in anew, raw VM, created in a data domain that has had VMs deleted from it,could use this flaw to read limited data from those deleted VMs,potentially disclosing sensitive information. (CVE-2010-2223)This updated package provides updated components that include fixes forsecurity issues; however, these issues have no security impact for Red HatEnterprise Virtualization Hypervisor. These fixes are for dbus issueCVE-2009-1189; kernel issues CVE-2010-0307, CVE-2010-0410, CVE-2010-0730,CVE-2010-1085, and CVE-2010-1086; openldap issue CVE-2009-3767; and sudoissues CVE-2010-0426, CVE-2010-0427, and CVE-2010-1163.This update also fixes several bugs and adds several enhancements.Documentation for these bug fixes and enhancements is available fromhttp://www.redhat.com/docs/en-US/RedHatEnterpriseVirtualization/2.2/html/Servers-5.5-2.2HypervisorSecurityUpdate As Red Hat Enterprise Virtualization Hypervisor is based on KVM, the bugfixes and enhancements from the KVM updates RHSA-2010:0271 andRHBA-2010:0419 have been included in this update. Also included are the bugfixes and enhancements from the Virtual Desktop Server Manager (VDSM)update RHSA-2010:0473, and fence-agents update RHBA-2010:0477.KVM: https://rhn.redhat.com/errata/RHSA-2010-0271.html andhttps://rhn.redhat.com/errata/RHBA-2010-0419.html VDSM: https://rhn.redhat.com/errata/RHSA-2010-0473.html fence-agents: https://rhn.redhat.com/errata/RHBA-2010-0477.html Users of the Red Hat Enterprise Virtualization Hypervisor are advised toupgrade to this updated package, which corrects these issues and adds theseenhancements.