{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for spice-vdagent-win that fixes one security issue and several\nbugs is now available.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available from the\nCVE link in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "spice-vdagent-win provides a service and an agent that can be installed and\nrun on Windows guests.\n\nAn unquoted search path flaw was found in the way the SPICE service was\ninstalled on Windows. Depending on the permissions of the directories in\nthe unquoted search path, a local, unprivileged user could use this flaw to\nhave a binary of their choosing executed with SYSTEM privileges.\n(CVE-2013-2152)\n\nThis update also fixes the following bugs:\n\n* Previously, due to issues with some Windows guest applications, RHEV\nSPICE agent stopped getting clipboard changes. Now, the agent uses a new\nAPI that keeps track of clipboard changes, without the need to \"trust\" the\nbehavior of other applications registered to the clipboard. (BZ#919451)\n\n* Previously, copying a .jpg or .png image file from specific applications,\nsuch as Mozilla Firefox, on a Windows guest, then pasting into a Linux\nclient, resulted in an empty or black and white image due to incorrect\npallete encoding in the guest vdagent. Now, the encoding has been fixed and\ncopying and pasting works as expected. (BZ#919150)\n\n* Previously, when using a Windows virtual machine, enabling extra monitors\nwith arbitrary configuration could fail. Now the agent enables the monitors\nbefore updating it to an arbitrary resolution to solve this issue.\n(BZ#922394)\n\n* Previously, if SPICE was disconnected in the middle of copying and\npasting data from the client to the guest, copy and paste would stop\nworking after SPICE was reconnected. Now, the clipboard timeout has been\nadjusted so that if SPICE is unexpectedly disconnected, the immediate copy\nand paste action will fail, but subsequent attempts will be successful.\n(BZ#833835)\n\n* Previously, when attempting to connect multiple displays using a Windows\n7 guest, remote-viewer would only show one display available, even when all\nsettings in the manager and on the SPICE client itself were correctly\nconfigured. This was caused by a regression issue relating to changes to\ncustom resolution commands. Now, connecting and displaying multiple\nmonitors functions correctly. (BZ#922283)\n\n* Previously, due to a regression caused by another patch, copying a .png\nimage from specific applications, such as Firefox, on a Linux client,\nfailed pasting into a Windows guest application, such as Paint, due to\nincorrect pallete encoding in the guest vdagent. Now, the encoding has been\nfixed and copying and pasting works as expected. (BZ#921980)\n\n* Previously, when a second user logged into a Windows guest, the RHEV\nSPICE Agent service terminated the previous vdagent instance, but\nmistakenly also the newly created vdagent on the current active session.\nNow, the vdagent termination event is reset after previous agent\ntermination, so each new agent is no longer terminated. (BZ#868254)\n\n* Previously, if \"RHEV SPICE agent\" was stopped after copying data from a\nWindows guest, the client was not correctly notified, and assumed it could\nstill paste the data. Now, agent termination has been fixed so that the\nclient is notified to release the clipboard. (BZ#903379)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0924",
        "url": "https://access.redhat.com/errata/RHSA-2013:0924"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "833835",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=833835"
      },
      {
        "category": "external",
        "summary": "868254",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=868254"
      },
      {
        "category": "external",
        "summary": "903379",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=903379"
      },
      {
        "category": "external",
        "summary": "922283",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=922283"
      },
      {
        "category": "external",
        "summary": "922394",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=922394"
      },
      {
        "category": "external",
        "summary": "971172",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=971172"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0924.json"
      }
    ],
    "title": "Red Hat Security Advisory: spice-vdagent-win security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T13:01:16+00:00",
      "generator": {
        "date": "2024-11-14T13:01:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2013:0924",
      "initial_release_date": "2013-06-10T20:20:00+00:00",
      "revision_history": [
        {
          "date": "2013-06-10T20:20:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-07-02T14:52:44+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T13:01:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEV-M 3.1",
                "product": {
                  "name": "RHEV-M 3.1",
                  "product_id": "RHEV-M 3.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhev_manager:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-2152",
      "cwe": {
        "id": "CWE-428",
        "name": "Unquoted Search Path or Element"
      },
      "discovery_date": "2013-04-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "971172"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Unquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.2, allows local users to gain privileges via a crafted application in an unspecified folder.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rhevm: spice service unquoted search path",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHEV-M 3.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-2152"
        },
        {
          "category": "external",
          "summary": "RHBZ#971172",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=971172"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-2152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-2152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2152"
        }
      ],
      "release_date": "2013-06-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-06-10T20:20:00+00:00",
          "details": "Red Hat Enterprise Virtualization users that are using SPICE to connect to\ntheir virtual machines are advised to install this update.",
          "product_ids": [
            "RHEV-M 3.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0924"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "products": [
            "RHEV-M 3.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rhevm: spice service unquoted search path"
    }
  ]
}