Citrix XenServer Multiple Security Updates (CTX202404)

Published: 2015-11-26 11:29:16
CVE Author: NIST National Vulnerability Database

CVSS Base Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C

Detection Method:
Check the installed hotfixes

Recommendations:
Apply the hotfix referenced in the advisory.

Summary:
A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to compromise the host and guest users to crash the host. These vulnerabilities affect all currently supported versions of Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1. The following vulnerabilities have been addressed: CVE-2015-7835 (High): Uncontrolled creation of large page mappings by PV guests CVE-2015-7969 (Low): Leak of main per-domain vcpu pointer array/Leak of per-domain profiling-related vcpu pointer array CVE-2015-7970 (Medium): Host crash when migrating a PoD VM CVE-2015-7971 (Low): Some pmu and profiling hypercalls log without rate limiting CVE-2015-7972 (Low): Populate-on-demand balloon size inaccuracy can crash guests

Affected Versions:
Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1

Solution Type:
Vendor Patch

Detection Type:
Linux Distribution Package

NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database)

https://nvd.nist.gov/vuln/detail/CVE-2015-7835
https://nvd.nist.gov/vuln/detail/CVE-2015-7969
https://nvd.nist.gov/vuln/detail/CVE-2015-7970
https://nvd.nist.gov/vuln/detail/CVE-2015-7971
https://nvd.nist.gov/vuln/detail/CVE-2015-7972

CVE Analysis

https://www.mageni.net/cve/CVE-2015-7835
https://www.mageni.net/cve/CVE-2015-7969
https://www.mageni.net/cve/CVE-2015-7970
https://www.mageni.net/cve/CVE-2015-7971
https://www.mageni.net/cve/CVE-2015-7972

References:

http://support.citrix.com/article/CTX202404

Severity
High
CVSS Score
7.2
Published
2015-11-26
Modified
2018-10-12
Category
Citrix Xenserver Local Security Checks

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.