PT-2007-5140 · Xen+1 · Xen+1

Steve Kemp · Publicado 2007-10-28 · Atualizado 2024-06-15 · CVE-2007-3919

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:L/AC:M/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Xen versions 3.1 and earlier

Description: The issue allows local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm, which is related to xenbaked and xenmon.py.

Recommendations: For Xen versions 3.1 and earlier, consider restricting access to the /tmp/xenq-shm file to prevent symlink attacks until a patch is available. As a temporary workaround, consider disabling the xenmon.py script until a patch is available. Avoid using xenbaked and xenmon.py in Xen versions 3.1 and earlier until the issue is resolved.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2007-3919

DSA-1395-1

OPENSUSE-SU-2024:11520-1

RHSA-2008:0194

RHSA-2008_0194

Produtos afetados

Red Hat

Xen

Referências · 121

• https://suse.com/security/cve/CVE-2020-29567 · Nota
• https://suse.com/security/cve/CVE-2020-27672 · Nota
• https://suse.com/security/cve/CVE-2020-15567 · Nota
• https://suse.com/security/cve/CVE-2019-17349 · Nota
• https://suse.com/security/cve/CVE-2016-7777 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3919 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-5244 · Nota
• https://suse.com/security/cve/CVE-2017-12137 · Nota
• https://suse.com/security/cve/CVE-2020-25596 · Nota
• https://suse.com/security/cve/CVE-2018-19961 · Nota
• https://suse.com/security/cve/CVE-2016-10025 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9913 · Nota
• https://suse.com/security/cve/CVE-2020-15566 · Nota
• https://suse.com/security/cve/CVE-2017-8309 · Nota
• https://suse.com/security/cve/CVE-2016-9932 · Nota