Citrix XenServer Multiple Vulnerabilities (CTX218775)

high Nessus Plugin ID 95539

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities :

- A flaw exists in the sniff_netware() function within file tools/pygrub/src/pygrub when handling string quotes and S-expressions in the bootloader whenever the S-expressions output format is requested. A guest attacker can exploit this to cause the bootloader configuration file to produce incorrect output, resulting in the disclosure or deletion of files from the host. (CVE-2016-9379)

- A flaw exists in the sniff_netware() function within file tools/pygrub/src/pygrub when handling NULL bytes in the bootloader whenever the null-delimited output format is requested. A guest attacker can exploit this to cause configuration files to output ambiguous or confusing results, resulting in the disclosure or deletion of files from the host. (CVE-2016-9380)

- A double-fetch flaw exists that is triggered when the compiler omits QEMU optimizations. A guest attacker can exploit this to gain elevated privileges on the host.
(CVE-2016-9381)

- A flaw exists in the hvm_task_switch() function within file arch/x86/hvm/hvm.c due to improper handling of x86 task switching to VM86 mode. A guest attacker can exploit this to cause a denial of service condition or gain elevated privileges within the guest environment.
(CVE-2016-9382)

- A flaw exists in the x86_emulate() function within file arch/x86/x86_emulate/x86_emulate.c that allows a guest attacker to cause changes to memory and thereby gain elevated privileges on the host. (CVE-2016-9383)

- A denial of service vulnerability exists in the x86 segment base write emulation that is related to lacking canonical address checks. A local attacker who has administrative rights within a guest can exploit this issue to crash the host. (CVE-2016-9385)

- A flaw exists in the x86 emulator due to improper checking of the usability of segments when performing memory accesses. A guest attacker can exploit this to gain elevated privileges. (CVE-2016-9386)

Solution

Apply the appropriate hotfix according to the vendor advisory.

See Also

https://support.citrix.com/article/CTX218775

Plugin Details

Severity: High

ID: 95539

File Name: citrix_xenserver_CTX218775.nasl

Version: 1.8

Type: local

Family: Misc.

Published: 12/5/2016

Updated: 11/13/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2016-9383

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:citrix:xenserver

Required KB Items: Host/local_checks_enabled, Host/XenServer/version

Exploit Ease: No known exploits are available

Patch Publication Date: 11/22/2016

Vulnerability Publication Date: 11/22/2016

Reference Information

CVE: CVE-2016-9379, CVE-2016-9380, CVE-2016-9381, CVE-2016-9382, CVE-2016-9383, CVE-2016-9385, CVE-2016-9386

BID: 94470, 94471, 94472, 94473, 94474, 94476