Detections
Analytics

OracleVM 3.4 : xen (OVMSA-2018-0039)

high Nessus Plugin ID 109545

Language:

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address critical security updates :

 - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

 - BUILDINFO: xen commit=b68fb6eb2d74ac16bb1e733c5fe5c9d9622b0838

 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

 - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

 - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

 - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

 - vnuma: don't fail guest creation if vnuma cannot be set (Elena Ufimtseva) [Orabug: 27734123]

 - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

 - BUILDINFO: xen commit=2446bf402a359332c21fe3f74d81a4c31191752f

 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

 - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

 - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

 - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

 - x86/vMSI-X: honor all mask requests (Jan Beulich) [Orabug: 27805894]

 - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

 - BUILDINFO: xen commit=b16b37d1e358a490d4cf930fe8efe1432d4723ef

 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

 - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

 - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

 - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

 - remove bogus file in the branch. (Elena Ufimtseva)

 - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8

 - BUILDINFO: xen commit=e1d84ac130fa17bafc394684ae9ba0eedfdca9a9

 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff

 - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba

 - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e

 - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee

 - x86/shadow: fix ref-counting error handling (Jan Beulich) [Orabug: 27803798] (CVE-2017-17564)

 - x86/shadow: fix refcount overflow check (Jan Beulich) [Orabug: 27803801] (CVE-2017-17563)

Solution

Update the affected xen / xen-tools packages.

See Also

https://oss.oracle.com/pipermail/oraclevm-errata/2018-May/000849.html

Plugin Details

Severity: High

ID: 109545

File Name: oraclevm_OVMSA-2018-0039.nasl

Version: 1.4

Type: local

Published: 5/3/2018

Updated: 9/27/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 5.1

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:xen, p-cpe:/a:oracle:vm:xen-tools, cpe:/o:oracle:vm_server:3.4

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/2/2018

Vulnerability Publication Date: 12/12/2017

Reference Information

CVE: CVE-2017-17563, CVE-2017-17564