LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: December 12th, 2014
Linux Security Week: December 9th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Ubuntu: xen-3.0 vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Ubuntu Joris van Rantwijk discovered that the Xen host did not correctly validate the contents of a Xen guests's grug.conf file. Xen guest root users could exploit this to run arbitrary commands on the host when the guest system was rebooted.
=========================================================== 
Ubuntu Security Notice USN-527-1           October 05, 2007
xen-3.0 vulnerability
CVE-2007-4993
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 7.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.04:
  xen-utils-3.0                   3.0.3-0ubuntu10.1

In general, a standard system upgrade is sufficient to affect the
necessary changes.

Details follow:

Joris van Rantwijk discovered that the Xen host did not correctly validate
the contents of a Xen guests's grug.conf file.  Xen guest root users could
exploit this to run arbitrary commands on the host when the guest system
was rebooted.


Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/x/xen-3.0/xen-3.0_3.0.3-0ubuntu10.1.diff.gz
      Size/MD5:    43307 2f531fea82cc88494f81bbdd050ef824
    http://security.ubuntu.com/ubuntu/pool/main/x/xen-3.0/xen-3.0_3.0.3-0ubuntu10.1.dsc
      Size/MD5:     1023 3336b4ce7f13d381400bb6d0a80cd0b7
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-3.0_3.0.3.orig.tar.gz
      Size/MD5:  5465571 98ac5465ff111a3ff76a985bf755c6a5

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-docs-3.0_3.0.3-0ubuntu10.1_all.deb
      Size/MD5:   533754 b65c9495bcfa717ed1a5b8c46f999402

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/x/xen-3.0/libxen3.0-dev_3.0.3-0ubuntu10.1_amd64.deb
      Size/MD5:    70804 ffc9f9d0ab7f8df7df2e0ffd8f08285c
    http://security.ubuntu.com/ubuntu/pool/main/x/xen-3.0/libxen3.0_3.0.3-0ubuntu10.1_amd64.deb
      Size/MD5:    73492 dd35493b60f4792e345abda43d20aa8b
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/python-xen3.0_3.0.3-0ubuntu10.1_amd64.deb
      Size/MD5:   420742 a1638f0e7cbbf5685b041abc158dfa8a
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-hypervisor-3.0-amd64_3.0.3-0ubuntu10.1_amd64.deb
      Size/MD5:   271940 66492dd5d6a4c52fc97114d2bb983ffa
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-ioemu-3.0_3.0.3-0ubuntu10.1_amd64.deb
      Size/MD5:   317284 88a2027bff8d08983d0d8771859e68fd
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-utils-3.0_3.0.3-0ubuntu10.1_amd64.deb
      Size/MD5:   283572 8e9197196e594faf891ce535014b6c71

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/x/xen-3.0/libxen3.0-dev_3.0.3-0ubuntu10.1_i386.deb
      Size/MD5:    70800 0295889477fb1b8c83edb7cfe2b6872a
    http://security.ubuntu.com/ubuntu/pool/main/x/xen-3.0/libxen3.0_3.0.3-0ubuntu10.1_i386.deb
      Size/MD5:    69486 b24236890f2ba901e4852188a72ebb22
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/python-xen3.0_3.0.3-0ubuntu10.1_i386.deb
      Size/MD5:   416932 81e667521fe88fe02db3355b42bf5e5b
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-hypervisor-3.0-i386-pae_3.0.3-0ubuntu10.1_i386.deb
      Size/MD5:   269408 1c2d69bafb3ca2d540dc13105ac40e10
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-hypervisor-3.0-i386_3.0.3-0ubuntu10.1_i386.deb
      Size/MD5:   251070 facaee8d4581cdbfe7682b30e87e8065
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-ioemu-3.0_3.0.3-0ubuntu10.1_i386.deb
      Size/MD5:   298840 6a863568a47389b1d2990c97bdcb2620
    http://security.ubuntu.com/ubuntu/pool/universe/x/xen-3.0/xen-utils-3.0_3.0.3-0ubuntu10.1_i386.deb
      Size/MD5:   272848 90980654788696fad35a613fcc562a88


 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
University of California, Berkeley Hacked, Data Compromised
London teen pleads guilty to Spamhaus DDoS
New England security group shares threat intelligence, strives to bolster region
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.