Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-1952 | First vendor Publication | 2008-06-23 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 2.1 | Attack Range | Local |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1952 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11189 | |||
| Oval ID: | oval:org.mitre.oval:def:11189 | ||
| Title: | The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory. | ||
| Description: | The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-1952 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22572 | |||
| Oval ID: | oval:org.mitre.oval:def:22572 | ||
| Title: | ELSA-2008:0892: xen security and bug fix update (Important) | ||
| Description: | The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:0892-01 CVE-2008-1945 CVE-2008-1952 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | xen |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:28930 | |||
| Oval ID: | oval:org.mitre.oval:def:28930 | ||
| Title: | RHSA-2008:0892 -- xen security and bug fix update (Important) | ||
| Description: | Updated xen packages that resolve a couple of security issues and fix a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2008:0892 CESA-2008:0892-CentOS 5 CVE-2008-1945 CVE-2008-1952 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | xen |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-06 | Name : RedHat Update for xen RHSA-2008:0892-01 File : nvt/gb_RHSA-2008_0892-01_xen.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 46542 | Xen PVFB Shared Framebuffer Handling DoS |
| 45443 | Xen Para Virtualized Frame Buffer (PVFB) Arbitrary Guest Memory Mapping dom0 DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2008-2007.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0892.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20081001_xen_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0892.nasl - Type : ACT_GATHER_INFO |
| 2008-10-02 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0892.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:14:08 |
|
| 2024-11-28 12:15:29 |
|
| 2021-05-04 12:07:27 |
|
| 2021-04-22 01:07:51 |
|
| 2020-05-23 00:21:37 |
|
| 2017-09-29 09:23:31 |
|
| 2017-08-08 09:24:03 |
|
| 2016-04-26 17:20:43 |
|
| 2014-11-27 13:27:19 |
|
| 2014-02-17 10:44:48 |
|
| 2013-05-11 00:15:54 |
|
