Citrix XenServer multiple vulnerabilities (CTX222565)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

A server virtualization platform installed on the remote host is
affected by multiple vulnerabilities.

Description :

The version of Citrix XenServer installed on the remote host is
missing a security hotfix. It is, therefore, affected by multiple
vulnerabilities :

- A flaw exists when invoking the instruction emulator
that is triggered during the handling of SYSCALL by
single-stepping applications. A local attacker can
exploit this to execute code with elevated privileges
on the guest. (CVE-2016-10013)

- An out-of-array memory access error exists in the
memory_exchange() function within file common/memory.c
due to improper checking of XENMEM_exchange input. An
attacker on a 64-bit PV guest VM who has administrative
privileges can exploit this issue to access arbitrary
system memory locations, which can then be potentially
used for further compromising the host. (CVE-2017-7228)

- A memory leak issue exits due to improper cleanup being
performed during guest destruction. An attacker on the
guest can exploit this, by repeatedly rebooting, to
exhaust memory on the host system, resulting in a denial
of service condition. (VulnDB 152191)

See also :

https://support.citrix.com/article/CTX222565

Solution :

Apply the appropriate hotfix according to the vendor advisory.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.0
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Misc.

Nessus Plugin ID: 99377 ()

Bugtraq ID: 94963
97375

CVE ID: CVE-2016-10013
CVE-2017-7228

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now