PT-2007-6103 · Xen+1 · Xen+1

Joris Van Rantwijk · Published 2007-09-27 · Updated 2018-10-15 · CVE-2007-4993

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xen version 3.0.3

Description The issue allows local users with elevated privileges in a guest domain to execute arbitrary commands in domain 0. This is achieved by creating a crafted grub.conf file, whose contents are then used in exec statements, potentially leading to unauthorized command execution.

Recommendations For Xen version 3.0.3, consider restricting access to the grub.conf file to prevent local users from crafting malicious configurations until a patch is available. As a temporary workaround, monitor domain 0 for suspicious activity and limit the privileges of guest domain users to minimize potential damage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-4993

DSA-1384-1

RHSA-2007:0323

RHSA-2007_0323

Affected Products

Red Hat

Xen

References · 27

• 🔥 https://exploit-db.com/exploits/30620 · Exploit
• http://redhat.com/support/errata/RHSA-2007-0323.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4993 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-October/msg00030.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00004.html · Vendor Advisory
• http://ubuntu.com/usn/usn-527-1 · Vendor Advisory
• http://secunia.com/advisories/26986 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:203 · Vendor Advisory
• http://debian.org/security/2007/dsa-1384 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-October/msg00082.html · Vendor Advisory
• http://secunia.com/advisories/27047 · Note
• http://vupen.com/english/advisories/2007/3348 · Note
• http://securityfocus.com/archive/1/481825/100/0/threaded · Note
• https://access.redhat.com/security/cve/CVE-2007-4993 · Note
• http://secunia.com/advisories/27161 · Note