PT-2009-5817 · Xen+1 · Xen+1

Jan Lieskovsky · Published 2009-10-01 · Updated 2017-09-19 · CVE-2009-3525

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 3.0.3, 3.3.0, 3.3.1

Description The issue concerns the pyGrub boot loader, which does not support password protection for para-virtualized guests as specified in the grub.conf file. This allows attackers with access to the guest console to boot the guest or alter its kernel boot parameters without entering the expected password.

Recommendations For Xen versions 3.0.3, 3.3.0, and 3.3.1, consider restricting access to the para-virtualized guest console to minimize the risk of unauthorized boot or modification of kernel parameters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3525

RHSA-2009:1472

RHSA-2009_1472

Affected Products

Red Hat

Xen

References · 14

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=525740 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=525740#c0 · Exploit
• 🔥 http://securityfocus.com/bid/36523 · Exploit
• 🔥 https://exploit-db.com/exploits/33255 · Exploit
• 🔥 http://xenbits.xensource.com/xen-unstable.hg?rev/8f783adc0ee3 · Exploit
• http://openwall.com/lists/oss-security/2009/09/25/1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-3525 · Security Note
• http://secunia.com/advisories/36908 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1472.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html · Vendor Advisory
• http://securitytracker.com/id?1022950 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9466 · Note
• https://access.redhat.com/errata/RHSA-2009:1472 · Note
• https://access.redhat.com/security/cve/CVE-2009-3525 · Note