Executive Summary
| Summary | |
|---|---|
| Title | xen security and bug fix update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2008:0892 | First vendor Publication | 2008-10-01 |
| Vendor | RedHat | Last vendor Modification | 2008-10-01 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.9 | Attack Range | Local |
| Cvss Impact Score | 6.9 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated xen packages that resolve a couple of security issues and fix a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Multi OS (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64 RHEL Virtualization (v. 5 server) - i386, ia64, x86_64 3. Description: The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. It was discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description properly. This could allow a privileged user in the unprivileged domain (DomU) to cause a denial of service, or, possibly, elevate privileges to the privileged domain (Dom0). (CVE-2008-1952) A flaw was found in the QEMU block format auto-detection, when running fully-virtualized guests and using Qemu images written on removable media (USB storage, 3.5" disks). Privileged users of such fully-virtualized guests (DomU), with a raw-formatted disk image, were able to write a header to that disk image describing another format. This could allow such guests to read arbitrary files in their hypervisor's host (Dom0). (CVE-2008-1945) Additionally, the following bug is addressed in this update: * The qcow-create command terminated when invoked due to glibc bounds checking on the realpath() function. Users of xen are advised to upgrade to these updated packages, which resolve these security issues and fix this bug. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 445844 - CVE-2008-1945 qemu/kvm/xen: add image format options for USB storage and removable media 447759 - CVE-2008-1952 qemu/xen/kvm: ioemu: Fix PVFB backend to limit frame buffer size 454651 - xen: buffer overflow detected: qcow-create terminated |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2008-0892.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11189 | |||
| Oval ID: | oval:org.mitre.oval:def:11189 | ||
| Title: | The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory. | ||
| Description: | The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-1952 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22572 | |||
| Oval ID: | oval:org.mitre.oval:def:22572 | ||
| Title: | ELSA-2008:0892: xen security and bug fix update (Important) | ||
| Description: | The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:0892-01 CVE-2008-1945 CVE-2008-1952 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | xen |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:28930 | |||
| Oval ID: | oval:org.mitre.oval:def:28930 | ||
| Title: | RHSA-2008:0892 -- xen security and bug fix update (Important) | ||
| Description: | Updated xen packages that resolve a couple of security issues and fix a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2008:0892 CESA-2008:0892-CentOS 5 CVE-2008-1945 CVE-2008-1952 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | xen |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7873 | |||
| Oval ID: | oval:org.mitre.oval:def:7873 | ||
| Title: | DSA-1799 qemu -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in the QEMU processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems: Ian Jackson discovered that range checks of file operations on emulated disk devices were insufficiently enforced. It was discovered that an error in the format auto detection of removable media could lead to the disclosure of files in the host system. A buffer overflow has been found in the emulation of the Cirrus graphics adaptor. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1799 CVE-2008-0928 CVE-2008-4539 CVE-2008-1945 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | qemu |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9905 | |||
| Oval ID: | oval:org.mitre.oval:def:9905 | ||
| Title: | QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004. | ||
| Description: | QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-1945 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 1 | |
| Os | 2 | |
| Os | 2 | |
| Os | 3 | |
| Os | 1 | |
| Os | 1 | |
| Os | 1 | |
| Os | 1 | |
| Os | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-06-05 | Name : Ubuntu USN-771-1 (libmodplug) File : nvt/ubuntu_771_1.nasl |
| 2009-06-05 | Name : Ubuntu USN-772-1 (mpfr) File : nvt/ubuntu_772_1.nasl |
| 2009-06-05 | Name : Ubuntu USN-773-1 (pango1.0) File : nvt/ubuntu_773_1.nasl |
| 2009-06-05 | Name : Ubuntu USN-774-1 (moin) File : nvt/ubuntu_774_1.nasl |
| 2009-06-05 | Name : Ubuntu USN-776-2 (kvm) File : nvt/ubuntu_776_2.nasl |
| 2009-05-20 | Name : Debian Security Advisory DSA 1799-1 (qemu) File : nvt/deb_1799_1.nasl |
| 2009-05-20 | Name : Ubuntu USN-776-1 (kvm) File : nvt/ubuntu_776_1.nasl |
| 2009-04-09 | Name : Mandriva Update for qemu MDVSA-2008:162 (qemu) File : nvt/gb_mandriva_MDVSA_2008_162.nasl |
| 2009-04-06 | Name : SuSE Security Summary SUSE-SR:2009:008 File : nvt/suse_sr_2009_008.nasl |
| 2009-03-06 | Name : RedHat Update for xen RHSA-2008:0892-01 File : nvt/gb_RHSA-2008_0892-01_xen.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 48798 | QEMU -usbdevice Option diskformat: Parameter Host OS Arbitrary File Access |
| 46542 | Xen PVFB Shared Framebuffer Handling DoS |
| 45443 | Xen Para Virtualized Frame Buffer (PVFB) Arbitrary Guest Memory Mapping dom0 DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2008-2007.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0892.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20081001_xen_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0892.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_qemu-090325.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_qemu-090325.nasl - Type : ACT_GATHER_INFO |
| 2009-05-14 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-776-2.nasl - Type : ACT_GATHER_INFO |
| 2009-05-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1799.nasl - Type : ACT_GATHER_INFO |
| 2009-05-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-776-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-162.nasl - Type : ACT_GATHER_INFO |
| 2009-04-03 | Name : The remote openSUSE host is missing a security update. File : suse_qemu-6123.nasl - Type : ACT_GATHER_INFO |
| 2008-10-02 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0892.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:51:58 |
|
