The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2008-1945: add image format options for USB storage     and removable media

  - CVE-2008-1952: included in fix for CVE-2008-1943     (3.1.4-0.1.3.el5)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0892 advisory.

    - Correctly limit PVFB size CVE-2008-1952 (rhbz #447760)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description properly. This could allow a privileged user in the unprivileged domain (DomU) to cause a denial of service, or, possibly, elevate privileges to the privileged domain (Dom0). (CVE-2008-1952)

A flaw was found in the QEMU block format auto-detection, when running fully-virtualized guests and using Qemu images written on removable media (USB storage, 3.5' disks). Privileged users of such fully-virtualized guests (DomU), with a raw-formatted disk image, were able to write a header to that disk image describing another format.
This could allow such guests to read arbitrary files in their hypervisor's host (Dom0). (CVE-2008-1945)

Additionally, the following bug is addressed in this update :

  - The qcow-create command terminated when invoked due to     glibc bounds checking on the realpath() function.

Updated xen packages that resolve a couple of security issues and fix a bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization.

It was discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description properly. This could allow a privileged user in the unprivileged domain (DomU) to cause a denial of service, or, possibly, elevate privileges to the privileged domain (Dom0). (CVE-2008-1952)

A flaw was found in the QEMU block format auto-detection, when running fully-virtualized guests and using Qemu images written on removable media (USB storage, 3.5' disks). Privileged users of such fully-virtualized guests (DomU), with a raw-formatted disk image, were able to write a header to that disk image describing another format.
This could allow such guests to read arbitrary files in their hypervisor's host (Dom0). (CVE-2008-1945)

Additionally, the following bug is addressed in this update :

* The qcow-create command terminated when invoked due to glibc bounds checking on the realpath() function.

Users of xen are advised to upgrade to these updated packages, which resolve these security issues and fix this bug.

ID	Name	Product	Family	Severity
79449	OracleVM 2.1 : xen (OVMSA-2008-2007)	Nessus	OracleVM Local Security Checks	medium
67749	Oracle Linux 5 : xen (ELSA-2008-0892)	Nessus	Oracle Linux Local Security Checks	high
60480	Scientific Linux Security Update : xen on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43711	CentOS 5 : xen (CESA-2008:0892)	Nessus	CentOS Local Security Checks	medium
34329	RHEL 5 : xen (RHSA-2008:0892)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2008-1952

high

Tenable Plugins

medium

high

medium

medium

medium