Detections
Analytics
OracleVM 3.3 : xen (OVMSA-2014-0025)
high Nessus Plugin ID 79541
Language:
Synopsis
The remote OracleVM host is missing one or more security updates.Description
The remote OracleVM system is missing necessary patches to address critical security updates :- x86/HVM: properly bound x2APIC MSR range This is XSA-108. Additional changelog comments added to 4.3.0-55.el6.0.0.3 (CVE-2014-7188)
- Fix for bug 19698535
- x86emul: only emulate software interrupt injection for real mode Protected mode emulation currently lacks proper privilege checking of the referenced IDT entry, and there's currently no legitimate way for any of the respective instructions to reach the emulator when the guest is in protected mode. This is XSA-106.
(CVE-2014-7156)
- x86/emulate: check cpl for all privileged instructions Without this, it is possible for userspace to load its own IDT or GDT. This is XSA-105. (CVE-2014-7155)
Solution
Update the affected xen / xen-tools packages.See Also
Plugin Details
Severity: High
ID: 79541
File Name: oraclevm_OVMSA-2014-0025.nasl
Version: 1.7
Type: local
Family: OracleVM Local Security Checks
Published: 11/26/2014
Updated: 1/4/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: High
Base Score: 8.3
Temporal Score: 6.1
Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:oracle:vm:xen, p-cpe:/a:oracle:vm:xen-tools, cpe:/o:oracle:vm_server:3.3
Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 10/1/2014
Vulnerability Publication Date: 10/2/2014