[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[RedHat] Mehrere Schwachstellen in der XEN Virtualisierungsumgebung vor Version 3.0.4 - RHSA-2007:0323-01
-----BEGIN PGP SIGNED MESSAGE-----
Hash: MD5
Liebe Kolleginnen und Kollegen,
soeben erreichte uns nachfolgendes RedHat Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.
CVE-2007-1320 - Heap Overflow in QEMU cirrus_invalidate_region()
In der Funktion cirrus_invalidate_region() zur Speicherverwaltung im
QEMU Cirrus Video Treiber, laesst sich ein Heap Overflow ausloesen,
weil nicht ausreichend ueberprueft wird, ob ueber die Grenzen von
Arrays hinaus geschrieben wird. Angreifer koennen diese Schwachstelle
dazu ausnutzen, beliebigen Code mit den Rechten des Emulators
auszufuehren.
CVE-2007-1321 - Heap Overflow im QEMU NE2000 Netzwerk Treiber
Der QEMU NE2000 Treiber ueberprueft nicht, ob Pakete kleiner als die
MTU sind, bevor sie in die Geraeteregister kopiert werden, wodurch ein
Heap Overflow ausgeloest werden kann. Angreifer koennen diese
Schwachstelle dazu ausnutzen, beliebigen Code mit den Rechten des
Emulators auszufuehren. Allerdings wird dieser Treiber von Xen nicht
per Default verwendet.
CVE-2007-4993 - Schwachstelle im Pygrub Bootloader der Xen
Virtualisierungsumgebung
Aufgrund von fehlerhaften 'exec()'-Statements in der Datei GrubConf.py
werden Konfigurationsdaten beim Starten eines Gastsystems ausgefuehrt,
ohne dass diese vorher ueberprueft werden. Ein Angreifer, der ueber
Administratorrechte auf einem Gastsystem verfuegt, kann aufgrund
dieser Schwachstelle beliebige Befehle in der Domaene 0 ausfuehren.
Betroffen sind die folgenden Software Pakete und Plattformen:
Paket xen
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Multi OS (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64
RHEL Virtualization (v. 5 server) - i386, ia64, x86_64
Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.
Hersteller Advisory:
https://rhn.redhat.com/errata/RHSA-2007-0323.html
(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.
Mit freundlichen Gruessen,
Jan Kohlrausch
- --
Jan Kohlrausch (CSIRT), Phone +49 40 808077-555
DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Heidenkampsweg 41, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: xen security update
Advisory ID: RHSA-2007:0323-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0323.html
Issue date: 2007-10-02
Updated on: 2007-10-02
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-1320 CVE-2007-1321 CVE-2007-4993
- - ---------------------------------------------------------------------
1. Summary:
An updated Xen package to fix multiple security issues is now available for
Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Multi OS (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64
RHEL Virtualization (v. 5 server) - i386, ia64, x86_64
3. Problem description:
The Xen package contains the tools for managing the virtual machine monitor
in Red Hat Enterprise Linux virtualization.
The following security flaws are fixed in the updated Xen package:
Joris van Rantwijk found a flaw in the Pygrub utility which is used as a
boot loader for guest domains. A malicious local administrator of a guest
domain could create a carefully crafted grub.conf file which would trigger
the execution of arbitrary code outside of that domain. (CVE-2007-4993)
Tavis Ormandy discovered a heap overflow flaw during video-to-video copy
operations in the Cirrus VGA extension code used in Xen. A malicious local
administrator of a guest domain could potentially trigger this flaw and
execute arbitrary code outside of the domain. (CVE-2007-1320)
Tavis Ormandy discovered insufficient input validation leading to a heap
overflow in the Xen NE2000 network driver. If the driver is in use, a
malicious local administrator of a guest domain could potentially trigger
this flaw and execute arbitrary code outside of the domain. Xen does not
use this driver by default. (CVE-2007-1321)
Users of Xen should update to these erratum packages containing backported
patches which correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
237342 - CVE-2007-1320 xen Cirrus LGD-54XX "bitblt" Heap Overflow
237343 - CVE-2007-1321 xen QEMU NE2000 emulation issues
302801 - CVE-2007-4993 xen guest root can escape to domain 0 through pygrub
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
x86_64:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
RHEL Desktop Multi OS (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
f41141cc620e161fedd68456d91c0103 xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
x86_64:
8821c1ad48035acc660ec5b1df3a1cb1 xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
ia64:
97d55e42bdc3fa09378f240db42d8dcb xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
09a0ab57a37644e796eb9d13efac90cb xen-libs-3.0.3-25.0.4.el5.ia64.rpm
x86_64:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
RHEL Virtualization (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
f41141cc620e161fedd68456d91c0103 xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
ia64:
aae6a104ac9d96a2258083a2037091e7 xen-3.0.3-25.0.4.el5.ia64.rpm
97d55e42bdc3fa09378f240db42d8dcb xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
fbf21cbabba81747c23c9462a88e934b xen-devel-3.0.3-25.0.4.el5.ia64.rpm
x86_64:
8821c1ad48035acc660ec5b1df3a1cb1 xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1320
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1321
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4993
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@xxxxxxxxxx>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFHArBvXlSAg2UNWIIRAtuRAKCT+Ro8K0H6Sq1OPzWgYeb3VQgVPQCgng8g
gdCMyoFY+nAF+ARNuggMWZI=
=8jdk
- -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iQEVAwUBRwTbeRYd1iQZmhQQAQF9Owf/Zn9V/mLJcFFqClHl5YllpLPJ4IHEJzCl
OJKRMtqQscI6DmCM3VJksKICVnbp90JdnhhFADp8c/n1D1ApPfXBbCg19iSOvk09
mF/aWk9z+nbo53o5J3joW6uHuTP6HxL67kzf82olaShUn4uT1t4nwAg7viRLPtZD
fgVUk8rKSPsCa2+qPQXytiucFMcLEPYmD7M1hvAy0HtfpMtNKrHYrN0l+KlFjVhV
aB12qyYI/dFGElWztKOhbVYpyHkKR58ppjuK+qfa2oi9jtf1p+08crf3Qa1AbxTP
i3O6dQY1NuEU1Ir11BFoiwfpThpkZVdr5P+HiCYuGx2VOtuk0lxvRw==
=VP36
-----END PGP SIGNATURE-----