SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Generic)  >   Xen Vendors:   XenSource
(Red Hat Issues Fix) Xen NE2000 Driver Heap Overflow May Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1018762
SecurityTracker URL:  http://securitytracker.com/id/1018762
CVE Reference:   CVE-2007-1321   (Links to External Site)
Date:  Oct 2 2007
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in Xen. A local user can obtain elevated privileges on the target system.

The Xen NE2000 network driver does not properly validate user-supplied input. A local user with administrative privileges in a guest domain can supply specially crafted data to potentially execute arbitrary commands on the target system outside of the target domain.

The driver is not used by default.

Tavis Ormandy reported this vulnerability.
Impact:   A local user can obtain root privileges on the target system.
Solution:   Red Hat has released a fix.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2007-0323.html
Vendor URL:  www.xensource.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   This archive entry is a follow-up to the message listed below.
Oct 2 2007 Xen NE2000 Driver Heap Overflow May Let Local Users Gain Elevated Privileges


 Source Message Contents
Date:  Tue, 2 Oct 2007 16:56:46 -0400
Subject:  [RHSA-2007:0323-01] Important: xen security update


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: xen security update
Advisory ID:       RHSA-2007:0323-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0323.html
Issue date:        2007-10-02
Updated on:        2007-10-02
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-1320 CVE-2007-1321 CVE-2007-4993 
- ---------------------------------------------------------------------

1. Summary:

An updated Xen package to fix multiple security issues is now available for
Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Multi OS (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64
RHEL Virtualization (v. 5 server) - i386, ia64, x86_64

3. Problem description:

The Xen package contains the tools for managing the virtual machine monitor
in Red Hat Enterprise Linux virtualization.

The following security flaws are fixed in the updated Xen package:

Joris van Rantwijk found a flaw in the Pygrub utility which is used as a
boot loader for guest domains.  A malicious local administrator of a guest
domain could create a carefully crafted grub.conf file which would trigger
the execution of arbitrary code outside of that domain. (CVE-2007-4993)

Tavis Ormandy discovered a heap overflow flaw during video-to-video copy
operations in the Cirrus VGA extension code used in Xen.  A malicious local
administrator of a guest domain could potentially trigger this flaw and
execute arbitrary code outside of the domain. (CVE-2007-1320)

Tavis Ormandy discovered insufficient input validation leading to a heap
overflow in the Xen NE2000 network driver.   If the driver is in use, a
malicious local administrator of a guest domain could potentially trigger
this flaw and execute arbitrary code outside of the domain.  Xen does not
use this driver by default. (CVE-2007-1321)

Users of Xen should update to these erratum packages containing backported
patches which correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

237342 - CVE-2007-1320 xen Cirrus LGD-54XX "bitblt" Heap Overflow
237343 - CVE-2007-1321 xen QEMU NE2000 emulation issues
302801 - CVE-2007-4993 xen guest root can escape to domain 0 through pygrub

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc  xen-3.0.3-25.0.4.el5.src.rpm

i386:
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835  xen-libs-3.0.3-25.0.4.el5.i386.rpm

x86_64:
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51  xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835  xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f  xen-libs-3.0.3-25.0.4.el5.x86_64.rpm

RHEL Desktop Multi OS (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc  xen-3.0.3-25.0.4.el5.src.rpm

i386:
f41141cc620e161fedd68456d91c0103  xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466  xen-devel-3.0.3-25.0.4.el5.i386.rpm

x86_64:
8821c1ad48035acc660ec5b1df3a1cb1  xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51  xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466  xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f  xen-devel-3.0.3-25.0.4.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc  xen-3.0.3-25.0.4.el5.src.rpm

i386:
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835  xen-libs-3.0.3-25.0.4.el5.i386.rpm

ia64:
97d55e42bdc3fa09378f240db42d8dcb  xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
09a0ab57a37644e796eb9d13efac90cb  xen-libs-3.0.3-25.0.4.el5.ia64.rpm

x86_64:
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51  xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835  xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f  xen-libs-3.0.3-25.0.4.el5.x86_64.rpm

RHEL Virtualization (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc  xen-3.0.3-25.0.4.el5.src.rpm

i386:
f41141cc620e161fedd68456d91c0103  xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466  xen-devel-3.0.3-25.0.4.el5.i386.rpm

ia64:
aae6a104ac9d96a2258083a2037091e7  xen-3.0.3-25.0.4.el5.ia64.rpm
97d55e42bdc3fa09378f240db42d8dcb  xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
fbf21cbabba81747c23c9462a88e934b  xen-devel-3.0.3-25.0.4.el5.ia64.rpm

x86_64:
8821c1ad48035acc660ec5b1df3a1cb1  xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862  xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51  xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466  xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f  xen-devel-3.0.3-25.0.4.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1320
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1321
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4993
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFHArBvXlSAg2UNWIIRAtuRAKCT+Ro8K0H6Sq1OPzWgYeb3VQgVPQCgng8g
gdCMyoFY+nAF+ARNuggMWZI=
=8jdk
-----END PGP SIGNATURE-----



-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2012, SecurityGlobal.net LLC