Two security fixes CVE-2013-4355 CVE-2013-4361, Set 'Domain-0' label in xenstored.service systemd file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: properly set up fbld emulation operand address This     is XSA-66. (CVE-2013-4361)

  - x86: properly handle hvm_copy_from_guest_[phys,virt]     errors Ignoring them generally implies using     uninitialized data and, in all cases dealt with here,     potentially leaking hypervisor stack contents to guests.
    This is XSA-63. (CVE-2013-4355)

Xen was updated to 4.1.6 c/s 23588 to fix various bugs and security issues.

Following changes are listed :

  - Comment out the -include directive in Config.mk as the     build service build seems to error out not finding     '.config' xen-config.diff

  - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored     mishandles oversized message replies

  - Improvements to block-dmmd script bnc#828623

  - bnc#840196 - MTU size on Dom0 gets reset when booting     DomU with e1000 device

  - bnc#840592 - CVE-2013-4355: XSA-63: xen: Information     leaks through I/O instruction emulation

  - bnc#841766 - CVE-2013-4361: XSA-66: xen: Information     leak through fbld instruction emulation

  - bnc#842511 - CVE-2013-4368: XSA-67: xen: Information     leak through outs instruction emulation

  - xen/27397-ACPI-fix-acpi_os_map_memory.patch: address     regression

  - bnc#839596 - CVE-2013-1442: XSA-62: xen: Information     leak on AVX and/or LWP capable CPUs

  - bnc#833251 - In HP&rsquo;s UEFI x86_64 platform and with     xen environment, in booting stage ,xen hypervisor will     panic.

  - bnc#833796 - Xen: migration broken from xsave-capable to     xsave-incapable host

  - bnc#834751 - In xen, &ldquo;shutdown &ndash;y 0     &ndash;h&rdquo; cannot power off system

  - bnc#833251 - In HP&rsquo;s UEFI x86_64 platform and with     xen environment, in booting stage ,xen hypervisor will     panic.

  - bnc#839600 - In HP&rsquo;s UEFI x86_64 platform and     sles11sp3 with xen environment, xen hypervisor will     panic on multiple blades nPar.

Multiple security issues have been discovered in the Xen virtualisation solution which may result in information leaks or denial of service.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details.

The remote host is affected by the vulnerability described in GLSA-201407-03 (Xen: Multiple Vunlerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can utilize multiple vectors to execute arbitrary       code, cause Denial of Service, or gain access to data on the host.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
70427	Fedora 18 : xen-4.2.3-3.fc18 (2013-18373)	Nessus	Fedora Local Security Checks	2013/10/15	2021/1/11	low
79517	OracleVM 3.2 : xen (OVMSA-2013-0070)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	low
75189	openSUSE Security Update : xen (openSUSE-SU-2013:1636-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
77240	Debian DSA-3006-1 : xen - security update	Nessus	Debian Local Security Checks	2014/8/19	2021/1/11	high
84140	OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)	Nessus	OracleVM Local Security Checks	2015/6/12	2021/1/4	low
76544	GLSA-201407-03 : Xen: Multiple Vunlerabilities	Nessus	Gentoo Local Security Checks	2014/7/17	2021/1/6	high

检测

插件搜索

low

low

medium

high

low

high