This script is Copyright (C) 2012 Tenable Network Security, Inc.
The remote Scientific Linux host is missing one or more security
CVE-2009-3525 Xen: PyGrub missing support for password configuration
The pyGrub boot loader did not honor the 'password' option in the
grub.conf file for para-virtualized guests. Users with access to a
guest's console could use this flaw to bypass intended access
restrictions and boot the guest with arbitrary kernel boot options,
allowing them to get root privileges in the guest's operating system.
With this update, pyGrub correctly honors the 'password' option in
grub.conf for para-virtualized guests. (CVE-2009-3525)
This update also fixes the following bugs :
- rebooting para-virtualized guests sometimes caused those
guests to crash due to a race condition in the xend node
control daemon. This update fixes this race condition so
that rebooting guests no longer potentially causes them
to crash and fail to reboot. (BZ#525141)
- due to a race condition in the xend daemon, a guest
could disappear from the list of running guests
following a reboot, even though the guest rebooted
successfully and was running. This update fixes this
race condition so that guests always reappear in the
guest list following a reboot. (BZ#525143)
- attempting to use PCI pass-through to para-virtualized
guests on certain kernels failed with a 'Function not
implemented' error message. As a result, users requiring
PCI pass-through on para-virtualized guests were not
able to update the xen packages without also updating
the kernel and thus requiring a reboot. These updated
packages enable PCI pass-through for para-virtualized
guests so that users do not need to upgrade the kernel
in order to take advantage of PCI pass-through
After installing the updatedpackages, the xend service must be
restarted for this update to take effect.
See also :
Update the affected xen, xen-devel and / or xen-libs packages.
Risk factor :
High / CVSS Base Score : 7.2
Family: Scientific Linux Local Security Checks
Nessus Plugin ID: 60674 ()
CVE ID: CVE-2009-3525
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.