New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Privilege escalation to hypervisor server vulnerability in Xen/KVM
http://seclists.org/fulldisclosure/2012/Oct/248?utm_source=twitterfeed&utm_medium=twitter
The XenServer remote VNC terminal emulator contains a vulnerability which would allow a user of a guest VM to get code executing in the hypervisor leading to elevation of privilege on the server on which the guest VM was being hosted.
It should be noted that the vulnerable code was also used in the QEMU-KVM terminal that can be used by emulated virtual machines; this is under a different CVE, CVE-2012-3515.
Thanked by 1gameon
Comments
Ty
http://www.securityfocus.com/bid/55413/exploit
Currently we are not aware of any exploits.
Not seeing how this something to be concerned about if you maintain your node. Fixes have been released https://rhn.redhat.com/errata/RHSA-2012-1325.html
Doesn't affect SolusVM systems, i checked with Phil.
I don't see how it couldn't, vnc is built into qemu on EL systems, and RH issued a fix, which will flow downstream.
What about proxmox?
Technologies Affected
Citrix XenServer 6.0
Citrix XenServer 5.6
Citrix XenServer 5.5
Citrix XenServer 5.0
http://www.securityfocus.com/bid/55413/info
Vulnerable: XenSource Xen 4.1.2
XenSource Xen 4.1.1
XenSource Xen 3.3.1
XenSource Xen 3.3
XenSource Xen 3.2
XenSource Xen 3.1.2
XenSource Xen 3.1.1
XenSource Xen 3.0.3
XenSource Xen 4.0
XenSource Xen 3.0
Ubuntu Ubuntu Linux 12.04 LTS i386
Ubuntu Ubuntu Linux 12.04 LTS amd64
Ubuntu Ubuntu Linux 11.10 i386
Ubuntu Ubuntu Linux 11.10 amd64
Ubuntu Ubuntu Linux 11.04 powerpc
Ubuntu Ubuntu Linux 11.04 i386
Ubuntu Ubuntu Linux 11.04 ARM
Ubuntu Ubuntu Linux 11.04 amd64
Ubuntu Ubuntu Linux 10.04 sparc
Ubuntu Ubuntu Linux 10.04 powerpc
Ubuntu Ubuntu Linux 10.04 i386
Ubuntu Ubuntu Linux 10.04 ARM
Ubuntu Ubuntu Linux 10.04 amd64
SuSE SUSE Linux Enterprise Server for VMware 11 SP2
Linux kernel 2.6.5
SuSE SUSE Linux Enterprise Server 11 SP2
Linux kernel 2.6.5
SuSE SUSE Linux Enterprise Server 10 SP4
Linux kernel 2.6.5
SuSE SUSE Linux Enterprise Server 10 SP2
SuSE SUSE Linux Enterprise SDK 11 SP2
SuSE SUSE Linux Enterprise SDK 10 SP4
SuSE SUSE Linux Enterprise Desktop 11 SP2
Linux kernel 2.6.5
SuSE SUSE Linux Enterprise Desktop 10 SP4
Linux kernel 2.6.5
SuSE Studio Standard Edition 1.2
SuSE Studio Extension for System z 1.2
SuSE openSUSE 12.1
SuSE openSUSE 11.4
RedHat Enterprise Linux Virtualization 5 server
RedHat Enterprise Linux Desktop Multi OS 5 client
Red Hat Fedora 16
Red Hat Enterprise Virtualization Hypervisor for RHEL 6 0
Red Hat Enterprise Virtualization Hypervisor for RHEL 5 0
Red Hat Enterprise Linux Workstation 6
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux HPC Node 6
Red Hat Enterprise Linux Desktop 6
Red Hat Enterprise Linux Desktop 5 client
Red Hat Enterprise Linux 5 Server
Oracle Enterprise Linux 6.2
Oracle Enterprise Linux 6
Oracle Enterprise Linux 5
Debian Linux 6.0 sparc
Debian Linux 6.0 s/390
Debian Linux 6.0 powerpc
Debian Linux 6.0 mips
Debian Linux 6.0 ia-64
Debian Linux 6.0 ia-32
Debian Linux 6.0 arm
Debian Linux 6.0 amd64