Skip to navigation

Security Advisory Important: xen security update

Advisory: RHSA-2007:0323-2
Type: Security Advisory
Severity: Important
Issued on: 2007-10-02
Last updated on: 2007-10-02
Affected Products: RHEL Desktop Multi OS (v. 5 client)
RHEL Virtualization (v. 5 server)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
CVEs (cve.mitre.org): CVE-2007-1320
CVE-2007-1321
CVE-2007-4993

Details

An updated Xen package to fix multiple security issues is now available for
Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

The Xen package contains the tools for managing the virtual machine monitor
in Red Hat Enterprise Linux virtualization.

The following security flaws are fixed in the updated Xen package:

Joris van Rantwijk found a flaw in the Pygrub utility which is used as a
boot loader for guest domains. A malicious local administrator of a guest
domain could create a carefully crafted grub.conf file which would trigger
the execution of arbitrary code outside of that domain. (CVE-2007-4993)

Tavis Ormandy discovered a heap overflow flaw during video-to-video copy
operations in the Cirrus VGA extension code used in Xen. A malicious local
administrator of a guest domain could potentially trigger this flaw and
execute arbitrary code outside of the domain. (CVE-2007-1320)

Tavis Ormandy discovered insufficient input validation leading to a heap
overflow in the Xen NE2000 network driver. If the driver is in use, a
malicious local administrator of a guest domain could potentially trigger
this flaw and execute arbitrary code outside of the domain. Xen does not
use this driver by default. (CVE-2007-1321)

Users of Xen should update to these erratum packages containing backported
patches which correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

RHEL Desktop Multi OS (v. 5 client)

SRPMS:
xen-3.0.3-25.0.4.el5.src.rpm
File outdated by:  RHBA-2013:0846
    MD5: 226cf2369c7df9af07a8494f310680dc
 
IA-32:
xen-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: f41141cc620e161fedd68456d91c0103
xen-devel-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: 29bcc93687b19f3388db33fbc7967466
 
x86_64:
xen-3.0.3-25.0.4.el5.x86_64.rpm
File outdated by:  RHBA-2013:0846
    MD5: 8821c1ad48035acc660ec5b1df3a1cb1
xen-devel-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: 29bcc93687b19f3388db33fbc7967466
xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
File outdated by:  RHBA-2013:0846
    MD5: 29ef0e6e5097bd82e44d8492bb8cfe5f
 
RHEL Virtualization (v. 5 server)

SRPMS:
xen-3.0.3-25.0.4.el5.src.rpm
File outdated by:  RHBA-2013:0846
    MD5: 226cf2369c7df9af07a8494f310680dc
 
IA-32:
xen-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: f41141cc620e161fedd68456d91c0103
xen-devel-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: 29bcc93687b19f3388db33fbc7967466
 
IA-64:
xen-3.0.3-25.0.4.el5.ia64.rpm
File outdated by:  RHBA-2013:0846
    MD5: aae6a104ac9d96a2258083a2037091e7
xen-devel-3.0.3-25.0.4.el5.ia64.rpm
File outdated by:  RHBA-2013:0846
    MD5: fbf21cbabba81747c23c9462a88e934b
 
x86_64:
xen-3.0.3-25.0.4.el5.x86_64.rpm
File outdated by:  RHBA-2013:0846
    MD5: 8821c1ad48035acc660ec5b1df3a1cb1
xen-devel-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: 29bcc93687b19f3388db33fbc7967466
xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
File outdated by:  RHBA-2013:0846
    MD5: 29ef0e6e5097bd82e44d8492bb8cfe5f
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
xen-3.0.3-25.0.4.el5.src.rpm
File outdated by:  RHBA-2013:0846
    MD5: 226cf2369c7df9af07a8494f310680dc
 
IA-32:
xen-libs-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: e4dca4285b1c8fd877527ec278e9d835
 
IA-64:
xen-libs-3.0.3-25.0.4.el5.ia64.rpm
File outdated by:  RHBA-2013:0846
    MD5: 09a0ab57a37644e796eb9d13efac90cb
 
x86_64:
xen-libs-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: e4dca4285b1c8fd877527ec278e9d835
xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
File outdated by:  RHBA-2013:0846
    MD5: 8869650a19cb4001e7aa1d1fa1dc562f
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
xen-3.0.3-25.0.4.el5.src.rpm
File outdated by:  RHBA-2013:0846
    MD5: 226cf2369c7df9af07a8494f310680dc
 
IA-32:
xen-libs-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: e4dca4285b1c8fd877527ec278e9d835
 
x86_64:
xen-libs-3.0.3-25.0.4.el5.i386.rpm
File outdated by:  RHBA-2013:0846
    MD5: e4dca4285b1c8fd877527ec278e9d835
xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
File outdated by:  RHBA-2013:0846
    MD5: 8869650a19cb4001e7aa1d1fa1dc562f
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

237342 - CVE-2007-1320 xen Cirrus LGD-54XX "bitblt" Heap Overflow
237343 - CVE-2007-1321 xen QEMU NE2000 emulation issues
302801 - CVE-2007-4993 xen guest root can escape to domain 0 through pygrub


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/