Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
  • Products & Services

    Products

    Support

    • Production Support
    • Development Support
    • Product Life Cycles

    Services

    • Consulting
    • Technical Account Management
    • Training & Certifications

    Documentation

    • Red Hat Enterprise Linux
    • Red Hat JBoss Enterprise Application Platform
    • Red Hat OpenStack Platform
    • Red Hat OpenShift Container Platform
    All Documentation

    Ecosystem Catalog

    • Red Hat Partner Ecosystem
    • Partner Resources
  • Tools

    Tools

    • Troubleshoot a product issue
    • Packages
    • Errata

    Customer Portal Labs

    • Configuration
    • Deployment
    • Security
    • Troubleshoot
    All labs

    Red Hat Insights

    Increase visibility into IT operations to detect and resolve technical issues before they impact your business.

    Learn More
    Go to Insights
  • Security

    Red Hat Product Security Center

    Engage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities.

    Product Security Center

    Security Updates

    • Security Advisories
    • Red Hat CVE Database
    • Security Labs

    Keep your systems secure with Red Hat's specialized responses to security vulnerabilities.

    View Responses

    Resources

    • Security Blog
    • Security Measurement
    • Severity Ratings
    • Backporting Policies
    • Product Signing (GPG) Keys
  • Community

    Customer Portal Community

    • Discussions
    • Private Groups
    Community Activity

    Customer Events

    • Red Hat Convergence
    • Red Hat Summit

    Stories

    • Red Hat Subscription Value
    • You Asked. We Acted.
    • Open Source Communities
Or troubleshoot an issue.

Select Your Language

  • English
  • Français
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Application Foundations
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
All Products
Red Hat Product Errata RHSA-2013:0924 - Security Advisory
Issued:
2013-06-10
Updated:
2013-06-10

RHSA-2013:0924 - Security Advisory

  • Overview

Synopsis

Important: spice-vdagent-win security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for spice-vdagent-win that fixes one security issue and several
bugs is now available.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

spice-vdagent-win provides a service and an agent that can be installed and
run on Windows guests.

An unquoted search path flaw was found in the way the SPICE service was
installed on Windows. Depending on the permissions of the directories in
the unquoted search path, a local, unprivileged user could use this flaw to
have a binary of their choosing executed with SYSTEM privileges.
(CVE-2013-2152)

This update also fixes the following bugs:

  • Previously, due to issues with some Windows guest applications, RHEV

SPICE agent stopped getting clipboard changes. Now, the agent uses a new
API that keeps track of clipboard changes, without the need to "trust" the
behavior of other applications registered to the clipboard. (BZ#919451)

  • Previously, copying a .jpg or .png image file from specific applications,

such as Mozilla Firefox, on a Windows guest, then pasting into a Linux
client, resulted in an empty or black and white image due to incorrect
pallete encoding in the guest vdagent. Now, the encoding has been fixed and
copying and pasting works as expected. (BZ#919150)

  • Previously, when using a Windows virtual machine, enabling extra monitors

with arbitrary configuration could fail. Now the agent enables the monitors
before updating it to an arbitrary resolution to solve this issue.
(BZ#922394)

  • Previously, if SPICE was disconnected in the middle of copying and

pasting data from the client to the guest, copy and paste would stop
working after SPICE was reconnected. Now, the clipboard timeout has been
adjusted so that if SPICE is unexpectedly disconnected, the immediate copy
and paste action will fail, but subsequent attempts will be successful.
(BZ#833835)

  • Previously, when attempting to connect multiple displays using a Windows

7 guest, remote-viewer would only show one display available, even when all
settings in the manager and on the SPICE client itself were correctly
configured. This was caused by a regression issue relating to changes to
custom resolution commands. Now, connecting and displaying multiple
monitors functions correctly. (BZ#922283)

  • Previously, due to a regression caused by another patch, copying a .png

image from specific applications, such as Firefox, on a Linux client,
failed pasting into a Windows guest application, such as Paint, due to
incorrect pallete encoding in the guest vdagent. Now, the encoding has been
fixed and copying and pasting works as expected. (BZ#921980)

  • Previously, when a second user logged into a Windows guest, the RHEV

SPICE Agent service terminated the previous vdagent instance, but
mistakenly also the newly created vdagent on the current active session.
Now, the vdagent termination event is reset after previous agent
termination, so each new agent is no longer terminated. (BZ#868254)

  • Previously, if "RHEV SPICE agent" was stopped after copying data from a

Windows guest, the client was not correctly notified, and assumed it could
still paste the data. Now, agent termination has been fixed so that the
client is notified to release the clipboard. (BZ#903379)

Solution

Red Hat Enterprise Virtualization users that are using SPICE to connect to
their virtual machines are advised to install this update.

Affected Products

  • Red Hat Virtualization 3 for RHEL 6 x86_64
  • Red Hat Virtualization 6 x86_64

Fixes

  • BZ - 833835 - copy-paste stops working after client disconnection during a copy-paste
  • BZ - 868254 - vdagent-win exits if two users are logged in simultaneously
  • BZ - 903379 - Stop the spice-vdagent on a Windows VM and the client right-click menu still shows you can paste with an empty clipboard.
  • BZ - 922283 - win-vdagent: does not enable extra displays
  • BZ - 922394 - --full-screen=auto-conf doesn't turn on disabled guest monitors
  • BZ - 971172 - CVE-2013-2152 rhevm: spice service unquoted search path

CVEs

  • CVE-2013-2152

References

  • https://access.redhat.com/security/updates/classification/#important

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

About

  • Red Hat Subscription Value
  • About Red Hat
  • Red Hat Jobs
2023
  • Privacy Statement
  • Terms of Use
  • All Policies and Guidelines
We've updated our <a href='http://www.redhat.com/en/about/privacy-policy' class='privacy-policy'>Privacy Statement</a> effective September 15, 2023.
Red Hat Summit Red Hat Summit
Twitter