Scientific Linux Security Update : xen on SL5.x i386/x86_64

This script is Copyright (C) 2012 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

CVE-2009-3525 Xen: PyGrub missing support for password configuration
command

The pyGrub boot loader did not honor the 'password' option in the
grub.conf file for para-virtualized guests. Users with access to a
guest's console could use this flaw to bypass intended access
restrictions and boot the guest with arbitrary kernel boot options,
allowing them to get root privileges in the guest's operating system.
With this update, pyGrub correctly honors the 'password' option in
grub.conf for para-virtualized guests. (CVE-2009-3525)

This update also fixes the following bugs :

- rebooting para-virtualized guests sometimes caused those
guests to crash due to a race condition in the xend node
control daemon. This update fixes this race condition so
that rebooting guests no longer potentially causes them
to crash and fail to reboot. (BZ#525141)

- due to a race condition in the xend daemon, a guest
could disappear from the list of running guests
following a reboot, even though the guest rebooted
successfully and was running. This update fixes this
race condition so that guests always reappear in the
guest list following a reboot. (BZ#525143)

- attempting to use PCI pass-through to para-virtualized
guests on certain kernels failed with a 'Function not
implemented' error message. As a result, users requiring
PCI pass-through on para-virtualized guests were not
able to update the xen packages without also updating
the kernel and thus requiring a reboot. These updated
packages enable PCI pass-through for para-virtualized
guests so that users do not need to upgrade the kernel
in order to take advantage of PCI pass-through
functionality. (BZ#525149)

After installing the updatedpackages, the xend service must be
restarted for this update to take effect.

See also :

http://www.nessus.org/u?cd440dff
https://bugzilla.redhat.com/show_bug.cgi?id=525141
https://bugzilla.redhat.com/show_bug.cgi?id=525143
https://bugzilla.redhat.com/show_bug.cgi?id=525149

Solution :

Update the affected xen, xen-devel and / or xen-libs packages.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 60674 ()

Bugtraq ID:

CVE ID: CVE-2009-3525