PT-2015-5632 · Xen+1 · Xen+1

Sander Eikelenboom · Publicado 2015-03-09 · Atualizado 2018-10-30 · CVE-2015-2152

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Xen versions 4.5.x and earlier

Description The issue allows local guest users to obtain access to the VGA console. This can be achieved by setting the DISPLAY environment variable when compiled with SDL support, or by connecting to the VNC server on ::1 or 127.0.0.1 when not compiled with SDL support.

Recommendations For Xen versions 4.5.x and earlier, consider disabling the VGA console emulation for x86 HVM guests as a temporary workaround until a patch is available. Restrict access to the VNC server to minimize the risk of exploitation. Avoid using the DISPLAY environment variable in affected configurations until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-2152

MGASA-2016-0098

OPENSUSE-SU-2015_0732-1

OPENSUSE-SU-2015_1092-1

SUSE-SU-2015:0613-1

Produtos afetados

Suse

Xen

Referências · 139

• 🔥 https://github.com/vincentbernat/cve-2015-3456 · Exploit
• https://bugzilla.suse.com/912011 · Nota
• http://xenbits.xen.org/xsa/advisory-118.html · Nota
• https://bugzilla.suse.com/921842 · Nota
• http://xenbits.xen.org/xsa/advisory-164.html · Nota
• https://osv.dev/vulnerability/MGASA-2016-0098 · Aviso do Fabricante
• http://xenbits.xen.org/xsa/advisory-120.html · Nota
• https://suse.com/security/cve/CVE-2015-4164.html · Nota
• https://suse.com/security/cve/CVE-2015-2751.html · Nota
• https://security.gentoo.org/glsa/201504-04 · Aviso do Fabricante
• https://bugzilla.suse.com/903680 · Nota
• http://xenbits.xen.org/xsa/advisory-124.html · Nota
• http://xenbits.xen.org/xsa/advisory-146.html · Nota
• https://advisories.mageia.org/MGASA-2016-0098.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-2045 · Nota