Uočene su i ispravljene višestruke ranjivosti u programskom paketu xen. Zloćudni korisnici su ih mogli iskoristiti za dobivanje većih privilegija i DoS napad.
Paket:
xen 4.x
Operacijski sustavi:
Fedora 16, Fedora 17
Kritičnost:
7.4
Problem:
pogreška u programskoj funkciji, preljev međuspremnika
Iskorištavanje:
lokalno
Posljedica:
dobivanje većih privilegija, uskraćivanje usluga (DoS)
Propusti su uočeni u funkciji za pozivanje jezgre sustava, prilikom senkvencionalnog izvršavanja programskog koda na starijim AMD procesorima, kodu za umetanje komponente General Protection Fault na gostujuća računala, emulatoru za MMIO operacije te zbog preljeva međuspremnika u funkciji "process_tx_desc".
Posljedica:
Lokalni napadač može ranjivosti iskoristiti za dobivanje većih ovlasti i izvođenje napada usraćivanja usluge (eng. Denial of Service, DoS).
Rješenje:
Svim korisnicima se savjetuje korištenje ispravljene inačice.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-11190
2012-07-28 00:38:29
--------------------------------------------------------------------------------
Name : xen
Product : Fedora 16
Version : 4.1.2
Release : 9.fc16
URL : http://xen.org/
Summary : Xen is a virtual machine monitor
Description :
This package contains the XenD daemon and xm command line
tools, needed to manage virtual machines running under the
Xen hypervisor
--------------------------------------------------------------------------------
Update Information:
in rare circumstances an unprivileged user can crash an HVM guest [XSA-10]
(#843766)
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jul 27 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-9
- in rare circumstances an unprivileged user can crash an HVM guest [XSA-10]
(#843766)
* Wed Jun 13 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-8
- make pygrub cope better with big files from guest (#818412 CVE-2012-2625)
- 64-bit PV guest privilege escalation vulnerability [CVE-2012-0217]
- guest denial of service on syscall/sysenter exception generation
[CVE-2012-0218]
- PV guest host Denial of Service [CVE-2012-2934]
* Tue May 8 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-7
- Make the udev tap rule more specific as it breaks openvpn (#819452)
- load xen-acpi-processor module (kernel 3.4 onwards) if present
* Thu Feb 2 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-6
- Fix buffer overflow in e1000 emulation for HVM guests [CVE-2012-0029]
* Sat Jan 28 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-5
- Start building xen's ocaml libraries if appropriate unless --without ocaml
was specified
- add some backported patches from xen unstable (via Debian) for some
ocaml tidying and fixes
* Sun Jan 15 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-4
- actually apply the xend-pci-loop.patch
- compile fixes for gcc-4.7
* Wed Jan 11 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-3
- Add xend-pci-loop.patch to stop xend crashing with weird PCI cards (#767742)
- avoid a backtrace if xend can't log to the standard file or a
temporary directory (part of #741042)
* Mon Nov 21 2011 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-2
- Fix lost interrupts on emulated devices
- stop xend crashing if its state files are empty at start up
- avoid a python backtrace if xend is run on bare metal
- update grub2 configuration after the old hypervisor has gone
- move blktapctrl to systemd
- Drop obsolete dom0-kernel.repo file
* Fri Oct 21 2011 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-1
- update to 4.1.2
remove upstream patches xen-4.1-testing.23104 and xen-4.1-testing.23112
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #843570 - CVE-2012-3432 kernel: xen: HVM guest user mode MMIO
emulation DoS
https://bugzilla.redhat.com/show_bug.cgi?id=843570
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update xen' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-11182
2012-07-27 09:16:04
--------------------------------------------------------------------------------
Name : xen
Product : Fedora 17
Version : 4.1.2
Release : 24.fc17
URL : http://xen.org/
Summary : Xen is a virtual machine monitor
Description :
This package contains the XenD daemon and xm command line
tools, needed to manage virtual machines running under the
Xen hypervisor
--------------------------------------------------------------------------------
Update Information:
in rare circumstances an unprivileged user can crash an HVM guest
[XSA-10] (#843766), remove a dependency on PyXML and Require python-lxml
instead of PyXML (#842843)
adjust systemd service files not to report failures when running without
a hypervisor or when xendomains.service doesn't find anything to start
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 26 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-24
- in rare circumstances an unprivileged user can crash an HVM guest [XSA-10]
* Tue Jul 24 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-23
- add a patch to remove a dependency on PyXML and Require python-lxml
instead of PyXML (#842843)
* Sun Jul 22 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-22
- adjust systemd service files not to report failures when running without
a hypervisor or when xendomains.service doesn't find anything to start
* Sun Jul 22 2012 Fedora Release Engineering <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> -
4.1.2-21
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Tue Jun 12 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-20
- Apply three security patches
64-bit PV guest privilege escalation vulnerability [CVE-2012-0217]
guest denial of service on syscall/sysenter exception generation
[CVE-2012-0218]
PV guest host Denial of Service [CVE-2012-2934]
* Sat Jun 9 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-19
- adjust xend.service systemd file to avoid selinux problems
* Fri Jun 8 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-18
- Enable xenconsoled by default under systemd (#829732)
* Thu May 17 2012 Michael Young <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 4.1.2-16 4.1.2-17
- make pygrub cope better with big files from guest (#818412 CVE-2012-2625)
- add patch from 4.1.3-rc2-pre to build on F17/8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #843570 - CVE-2012-3432 kernel: xen: HVM guest user mode MMIO
emulation DoS
https://bugzilla.redhat.com/show_bug.cgi?id=843570
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update xen' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke