PT-2008-5648 · Citrix+1 · Xen+1
Daniel Berrangé
·
Publicado
2008-10-03
·
Atualizado
2017-09-29
·
CVE-2008-4405
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Xen version 3.0.3
Description:
The issue is related to the xend in Xen, which does not properly limit the contents of the /local/domain xenstore directory tree and does not properly restrict a guest VM's write access within this tree. This allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to console/tty, console/limit, or image/device-model-pid.
Recommendations:
For Xen version 3.0.3, consider restricting write access to the xenstore directory tree to prevent guest OS users from causing a denial of service. As a temporary workaround, limit the guest VM's ability to write to console/tty, console/limit, and image/device-model-pid until a patch is available.
Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Xen