CentOS 5 : xen (CESA-2008:0194)

high Nessus Plugin ID 43678

Language:

Synopsis

The remote CentOS host is missing one or more security updates.

Description

Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization.

These updated packages fix the following security issues :

Daniel P. Berrange discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the format of messages serving to update the contents of the framebuffer. This could allow a malicious user to cause a denial of service, or compromise the privileged domain (Dom0). (CVE-2008-1944)

Markus Armbruster discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description. This could allow a malicious user to cause a denial of service, or to use a specially crafted frontend to compromise the privileged domain (Dom0). (CVE-2008-1943)

Chris Wright discovered a security vulnerability in the QEMU block format auto-detection, when running fully-virtualized guests. Such fully-virtualized guests, with a raw formatted disk image, were able to write a header to that disk image describing another format. This could allow such guests to read arbitrary files in their hypervisor's host. (CVE-2008-2004)

Ian Jackson discovered a security vulnerability in the QEMU block device drivers backend. A guest operating system could issue a block device request and read or write arbitrary memory locations, which could lead to privilege escalation. (CVE-2008-0928)

Tavis Ormandy found that QEMU did not perform adequate sanity-checking of data received via the 'net socket listen' option. A malicious local administrator of a guest domain could trigger this flaw to potentially execute arbitrary code outside of the domain. (CVE-2007-5730)

Steve Kemp discovered that the xenbaked daemon and the XenMon utility communicated via an insecure temporary file. A malicious local administrator of a guest domain could perform a symbolic link attack, causing arbitrary files to be truncated. (CVE-2007-3919)

As well, in the previous xen packages, it was possible for Dom0 to fail to flush data from a fully-virtualized guest to disk, even if the guest explicitly requested the flush. This could cause data integrity problems on the guest. In these updated packages, Dom0 always respects the request to flush to disk.

Users of xen are advised to upgrade to these updated packages, which resolve these issues.

Solution

Update the affected xen packages.

See Also

http://www.nessus.org/u?b79107ec

http://www.nessus.org/u?58bc144c

Plugin Details

Severity: High

ID: 43678

File Name: centos_RHSA-2008-0194.nasl

Version: 1.16

Type: local

Agent: unix

Published: 1/6/2010

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:centos:centos:xen, p-cpe:/a:centos:centos:xen-devel, p-cpe:/a:centos:centos:xen-libs, cpe:/o:centos:centos:5

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/15/2008

Vulnerability Publication Date: 10/28/2007

Reference Information

CVE: CVE-2007-3919, CVE-2007-5730, CVE-2008-0928, CVE-2008-1943, CVE-2008-1944, CVE-2008-2004

BID: 23731

CWE: 119, 200, 264, 59

RHSA: 2008:0194