This update fixes various bugs in XEN :

The following security issues have been fixed :

  - A denial of service (Host Crash) in the XEN hypervisor.
    (CVE-2011-2901)

  - A bug was found in the way Xen handles CPUID instruction     emulation during VM exits. An unprivileged guest user     can potentially use this flaw to crash the guest.
    (CVE-2011-1936)

  - A 64-bit guest can get one of its vcpus into non-kernel     mode without first providing a valid non-kernel     pagetable. The observed failure mode was usually a hard     lockup of the host (host denial of service).
    (CVE-2011-1166)

It fixes also the following bugs :

  - SLES 10 SP3 XEN: Device /dev/xvdp is already connected     error when starting multiple vm's. (bnc#654798)

  - HVM taking too long to dump vmcore. (bnc#684297)

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - COS kernel
  - cURL
  - python
  - rpm

Several vulnerabilities were discovered in the Xen virtual machine hypervisor.

  - CVE-2011-1166     A 64-bit guest can get one of its vCPUs into non-kernel     mode without first providing a valid non-kernel     pagetable, thereby locking up the host system.

  - CVE-2011-1583, CVE-2011-3262     Local users can cause a denial of service and possibly     execute arbitrary code via a crafted paravirtualised     guest kernel image.

  - CVE-2011-1898     When using PCI passthrough on Intel VT-d chipsets that     do not have interrupt remapping, guest OS users can gain     host OS privileges by writing to the interrupt injection     registers.

The oldstable distribution (lenny) contains a different version of Xen not affected by these problems.

Collective May/2011 update for Xen

Xen :

  - 691238 - L3: question on behaviour change xm list

  - 623680 - xen kernel freezes during boot when processor     module is loaded

  - 680824 - dom0 can't recognize boot disk when IOMMU is     enabled

  - 688473 - VUL-0: potential buffer overflow in tools

  - 679344 - VUL-0: Xen: multi-vCPU pv guest may crash host

  - 687981 - L3: mistyping model type when defining VIF     crashes

  - 675817 - Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871 - dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related

  - 678229 - restore of sles HVM fails

  - 672833 - xen-tools bug causing problems with Ubuntu     10.10 under Xen 4.

  - 665610 - xm console > 1 to same VM messes up both     consoles

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

a. ESX third-party update for Service Console kernel      The ESX Service Console Operating System (COS) kernel is updated to    kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the    COS kernel.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,    CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,    CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,    CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,    CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,    CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,    CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,    CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,    CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,    CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
  b. ESX third-party update for Service Console cURL RPM      The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9    resolving a security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2011-2192 to this issue.
  c. ESX third-party update for Service Console nspr and nss RPMs      The ESX Service Console (COS) nspr and nss RPMs are updated to    nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving    a security issues.
     A Certificate Authority (CA) issued fraudulent SSL certificates and    Netscape Portable Runtime (NSPR) and Network Security Services (NSS)    contain the built-in tokens of this fraudulent Certificate    Authority. This update renders all SSL certificates signed by the    fraudulent CA as untrusted for all uses.
  d. ESX third-party update for Service Console rpm RPMs      The ESX Service Console Operating System (COS) rpm packages are    updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,    rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2    which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-2059 and CVE-2011-3378 to these    issues.
  e. ESX third-party update for Service Console samba RPMs      The ESX Service Console Operating System (COS) samba packages are    updated to samba-client-3.0.33-3.29.el5_7.4,    samba-common-3.0.33-3.29.el5_7.4 and    libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security    issues in the Samba client.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,    CVE-2011-2522 and CVE-2011-2694 to these issues.
     Note that ESX does not include the Samba Web Administration Tool    (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and    CVE-2011-2694.
  f. ESX third-party update for Service Console python package      The ESX Service Console (COS) python package is updated to    2.4.3-44 which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and    CVE-2011-1521 to these issues.
  g. ESXi update to third-party component python      The python third-party library is updated to python 2.5.6 which    fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,    CVE-2010-2089, and CVE-2011-1521 to these issues.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - A flaw in the dccp_rcv_state_process() function could     allow a remote attacker to cause a denial of service,     even when the socket was already closed. (CVE-2011-1093,     Important)

  - Multiple buffer overflow flaws were found in the Linux     kernel's Management Module Support for Message Passing     Technology (MPT) based controllers. A local,     unprivileged user could use these flaws to cause a     denial of service, an information leak, or escalate     their privileges. (CVE-2011-1494, CVE-2011-1495,     Important)

  - A missing validation of a null-terminated string data     structure element in the bnep_sock_ioctl() function     could allow a local user to cause an information leak or     a denial of service. (CVE-2011-1079, Moderate)

  - Missing error checking in the way page tables were     handled in the Xen hypervisor implementation could allow     a privileged guest user to cause the host, and the     guests, to lock up. (CVE-2011-1166, Moderate)

  - A flaw was found in the way the Xen hypervisor     implementation checked for the upper boundary when     getting a new event channel port. A privileged guest     user could use this flaw to cause a denial of service or     escalate their privileges. (CVE-2011-1763, Moderate)

  - The start_code and end_code values in '/proc/[pid]/stat'     were not protected. In certain scenarios, this flaw     could be used to defeat Address Space Layout     Randomization (ASLR). (CVE-2011-0726, Low)

  - A missing initialization flaw in the     sco_sock_getsockopt() function could allow a local,     unprivileged user to cause an information leak.
    (CVE-2011-1078, Low)

  - A missing validation of a null-terminated string data     structure element in the do_replace() function could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1080, Low)

  - A buffer overflow flaw in the DEC Alpha OSF partition     implementation in the Linux kernel could allow a local     attacker to cause an information leak by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1163, Low)

  - Missing validations of null-terminated string data     structure elements in the do_replace(),     compat_do_replace(), do_ipt_get_ctl(),     do_ip6t_get_ctl(), and do_arpt_get_ctl() functions could     allow a local user who has the CAP_NET_ADMIN capability     to cause an information leak. (CVE-2011-1170,     CVE-2011-1171, CVE-2011-1172, Low)

  - A heap overflow flaw in the Linux kernel's EFI GUID     Partition Table (GPT) implementation could allow a local     attacker to cause a denial of service by mounting a disk     that contains specially crafted partition tables.
    (CVE-2011-1577, Low)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
56618	SuSE 10 Security Update : Xen (ZYPP Patch Number 7703)	Nessus	SuSE Local Security Checks	2011/10/24	2021/1/19	medium
89105	VMware ESX / ESXi Service Console and Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0001) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	high
56716	Debian DSA-2337-1 : xen - several vulnerabilities	Nessus	Debian Local Security Checks	2011/11/7	2021/1/11	high
75776	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0580-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
57749	VMSA-2012-0001 : VMware ESXi and ESX updates to third-party library and ESX Service Console	Nessus	VMware ESX Local Security Checks	2012/1/31	2021/1/6	high
61059	Scientific Linux Security Update : kernel on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

检测

插件搜索

medium

high

high

medium

high

high