Home / mailings [RHSA-2007:0323-01] Important: xen security update
Posted on 02 October 2007
RedHat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: xen security update
Advisory ID: RHSA-2007:0323-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0323.html
Issue date: 2007-10-02
Updated on: 2007-10-02
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-1320 CVE-2007-1321 CVE-2007-4993
- ---------------------------------------------------------------------
1. Summary:
An updated Xen package to fix multiple security issues is now available for
Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Multi OS (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64
RHEL Virtualization (v. 5 server) - i386, ia64, x86_64
3. Problem description:
The Xen package contains the tools for managing the virtual machine monitor
in Red Hat Enterprise Linux virtualization.
The following security flaws are fixed in the updated Xen package:
Joris van Rantwijk found a flaw in the Pygrub utility which is used as a
boot loader for guest domains. A malicious local administrator of a guest
domain could create a carefully crafted grub.conf file which would trigger
the execution of arbitrary code outside of that domain. (CVE-2007-4993)
Tavis Ormandy discovered a heap overflow flaw during video-to-video copy
operations in the Cirrus VGA extension code used in Xen. A malicious local
administrator of a guest domain could potentially trigger this flaw and
execute arbitrary code outside of the domain. (CVE-2007-1320)
Tavis Ormandy discovered insufficient input validation leading to a heap
overflow in the Xen NE2000 network driver. If the driver is in use, a
malicious local administrator of a guest domain could potentially trigger
this flaw and execute arbitrary code outside of the domain. Xen does not
use this driver by default. (CVE-2007-1321)
Users of Xen should update to these erratum packages containing backported
patches which correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
237342 - CVE-2007-1320 xen Cirrus LGD-54XX "bitblt" Heap Overflow
237343 - CVE-2007-1321 xen QEMU NE2000 emulation issues
302801 - CVE-2007-4993 xen guest root can escape to domain 0 through pygrub
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
x86_64:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
RHEL Desktop Multi OS (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
f41141cc620e161fedd68456d91c0103 xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
x86_64:
8821c1ad48035acc660ec5b1df3a1cb1 xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
ia64:
97d55e42bdc3fa09378f240db42d8dcb xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
09a0ab57a37644e796eb9d13efac90cb xen-libs-3.0.3-25.0.4.el5.ia64.rpm
x86_64:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
RHEL Virtualization (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-25.0.4.el5.src.rpm
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
f41141cc620e161fedd68456d91c0103 xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
ia64:
aae6a104ac9d96a2258083a2037091e7 xen-3.0.3-25.0.4.el5.ia64.rpm
97d55e42bdc3fa09378f240db42d8dcb xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
fbf21cbabba81747c23c9462a88e934b xen-devel-3.0.3-25.0.4.el5.ia64.rpm
x86_64:
8821c1ad48035acc660ec5b1df3a1cb1 xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1320
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1321
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4993
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
