Vulnerabilities > CVE-2007-3919 - Link Following vulnerability in Xensource INC XEN 3.0.301/3.0.303
Attack vector
LOCAL Attack complexity
MEDIUM Privileges required
SINGLE Confidentiality impact
NONE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
(1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
OS | 12 | |
Application | 2 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Symlink Attack An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the attacker may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the attacker may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the attacker to control the actions of the target or to cause the target to expose information to the attacker. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the attacker would normally have.
- Accessing, Modifying or Executing Executable Files An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating Input to File System Calls An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Nessus
NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0194.NASL description Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 43678 published 2010-01-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43678 title CentOS 5 : xen (CESA-2008:0194) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2008:0194 and # CentOS Errata and Security Advisory 2008:0194 respectively. # include("compat.inc"); if (description) { script_id(43678); script_version("1.15"); script_cvs_date("Date: 2019/10/25 13:36:04"); script_cve_id("CVE-2007-3919", "CVE-2007-5730", "CVE-2008-0928", "CVE-2008-1943", "CVE-2008-1944", "CVE-2008-2004"); script_bugtraq_id(23731); script_xref(name:"RHSA", value:"2008:0194"); script_name(english:"CentOS 5 : xen (CESA-2008:0194)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the format of messages serving to update the contents of the framebuffer. This could allow a malicious user to cause a denial of service, or compromise the privileged domain (Dom0). (CVE-2008-1944) Markus Armbruster discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description. This could allow a malicious user to cause a denial of service, or to use a specially crafted frontend to compromise the privileged domain (Dom0). (CVE-2008-1943) Chris Wright discovered a security vulnerability in the QEMU block format auto-detection, when running fully-virtualized guests. Such fully-virtualized guests, with a raw formatted disk image, were able to write a header to that disk image describing another format. This could allow such guests to read arbitrary files in their hypervisor's host. (CVE-2008-2004) Ian Jackson discovered a security vulnerability in the QEMU block device drivers backend. A guest operating system could issue a block device request and read or write arbitrary memory locations, which could lead to privilege escalation. (CVE-2008-0928) Tavis Ormandy found that QEMU did not perform adequate sanity-checking of data received via the 'net socket listen' option. A malicious local administrator of a guest domain could trigger this flaw to potentially execute arbitrary code outside of the domain. (CVE-2007-5730) Steve Kemp discovered that the xenbaked daemon and the XenMon utility communicated via an insecure temporary file. A malicious local administrator of a guest domain could perform a symbolic link attack, causing arbitrary files to be truncated. (CVE-2007-3919) As well, in the previous xen packages, it was possible for Dom0 to fail to flush data from a fully-virtualized guest to disk, even if the guest explicitly requested the flush. This could cause data integrity problems on the guest. In these updated packages, Dom0 always respects the request to flush to disk. Users of xen are advised to upgrade to these updated packages, which resolve these issues." ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014903.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?b79107ec" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014904.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?58bc144c" ); script_set_attribute(attribute:"solution", value:"Update the affected xen packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(59, 119, 200, 264); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen-libs"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/10/28"); script_set_attribute(attribute:"patch_publication_date", value:"2008/05/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/06"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-5", reference:"xen-3.0.3-41.el5_1.5")) flag++; if (rpm_check(release:"CentOS-5", reference:"xen-devel-3.0.3-41.el5_1.5")) flag++; if (rpm_check(release:"CentOS-5", reference:"xen-libs-3.0.3-41.el5_1.5")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xen / xen-devel / xen-libs"); }
NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-203.NASL description Tavis Ormandy discovered a heap overflow flaw during video-to-video copy operations in the Cirrus VGA extension code that is used in Xen. A malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain (CVE-2007-1320). Tavis Ormandy also discovered insufficient input validation leading to a heap overflow in the NE2000 network driver in Xen. If the driver is in use, a malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain (CVE-2007-1321, CVE-2007-5729, CVE-2007-5730). Steve Kemp found that xen-utils used insecure temporary files within the xenmon tool that could allow local users to truncate arbitrary files (CVE-2007-3919). Joris van Rantwijk discovered a flaw in Pygrub, which is used as a boot loader for guest domains. A malicious local administrator of a guest domain could create a carefully-crafted grub.conf file which could trigger the execution of arbitrary code outside of that domain (CVE-2007-4993). Updated packages have been patched to prevent these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 27614 published 2007-11-02 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27614 title Mandrake Linux Security Advisory : xen (MDKSA-2007:203) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandrake Linux Security Advisory MDKSA-2007:203. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(27614); script_version ("1.20"); script_cvs_date("Date: 2019/08/02 13:32:49"); script_cve_id( "CVE-2007-1320", "CVE-2007-1321", "CVE-2007-3919", "CVE-2007-4993", "CVE-2007-5729", "CVE-2007-5730" ); script_bugtraq_id(23731); script_xref(name:"MDKSA", value:"2007:203"); script_name(english:"Mandrake Linux Security Advisory : xen (MDKSA-2007:203)"); script_summary(english:"Checks rpm output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Mandrake Linux host is missing a security update." ); script_set_attribute( attribute:"description", value: "Tavis Ormandy discovered a heap overflow flaw during video-to-video copy operations in the Cirrus VGA extension code that is used in Xen. A malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain (CVE-2007-1320). Tavis Ormandy also discovered insufficient input validation leading to a heap overflow in the NE2000 network driver in Xen. If the driver is in use, a malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain (CVE-2007-1321, CVE-2007-5729, CVE-2007-5730). Steve Kemp found that xen-utils used insecure temporary files within the xenmon tool that could allow local users to truncate arbitrary files (CVE-2007-3919). Joris van Rantwijk discovered a flaw in Pygrub, which is used as a boot loader for guest domains. A malicious local administrator of a guest domain could create a carefully-crafted grub.conf file which could trigger the execution of arbitrary code outside of that domain (CVE-2007-4993). Updated packages have been patched to prevent these issues." ); script_set_attribute(attribute:"solution", value:"Update the affected xen package."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_cwe_id(20, 59, 119, 189); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:xen"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2007"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2007.1"); script_set_attribute(attribute:"patch_publication_date", value:"2007/11/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/11/02"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK2007.0", reference:"xen-3.0.3-0.20060703.3.1mdv2007.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2007.1", reference:"xen-3.0.3-0.20060703.5.1mdv2007.1", yank:"mdv")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Scientific Linux Local Security Checks NASL id SL_20080513_XEN_ON_SL5_X.NASL description Note: Troy Dawson has tested this update on a machine hosting both paravirtualized and fully virtualized machines, both 32 bit and 64 bit. He did the update while all the machines were running, none of them had any problems. He also tried stopping, starting, and rebooting several of the machines. All without any problems. We tell you this because updating the xen package, while running virtual machines, can make you a little nervous. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 60398 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60398 title Scientific Linux Security Update : xen on SL5.x i386/x86_64 NASL family Fedora Local Security Checks NASL id FEDORA_2008-2083.NASL description - Sat Feb 23 2008 Daniel P. Berrange <berrange at redhat.com> - 3.1.2-2.fc7 - Fix block device extents check (rhbz #433560) - Sat Dec 1 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.2-1.fc7 - Upgrade to 3.1.2 bugfix release - Fri Oct 26 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-8.fc7 - Fixed xenbaked tmpfile flaw (CVE-2007-3919) - Wed Sep 26 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-7.fc7 - Fixed rtl8139 checksum calculation for Vista (rhbz #308201) - Wed Sep 26 2007 Chris Lalancette <clalance at redhat.com> - 3.1.0-6.fc7 - QEmu NE2000 overflow check - CVE-2007-1321 - Pygrub guest escape - CVE-2007-4993 - Mon Sep 24 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-5.fc7 - Fix generation of manual pages (rhbz #250791) - Fix 32-on-64 PVFB for FC6 legacy guests - Mon Sep 24 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-4.fc7 - Fix VMX assist IRQ handling (rhbz #279581) - Sun Sep 23 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-3.fc7 - Don last seen 2020-06-01 modified 2020-06-02 plugin id 31316 published 2008-02-29 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/31316 title Fedora 7 : xen-3.1.2-2.fc7 (2008-2083) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0194.NASL description Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 32354 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/32354 title RHEL 5 : xen (RHSA-2008:0194) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1395.NASL description Steve Kemp from the Debian Security Audit project discovered that xen-utils, a collection of XEN administrative tools, used temporary files insecurely within the xenmon tool allowing local users to truncate arbitrary files. last seen 2020-06-01 modified 2020-06-02 plugin id 27577 published 2007-10-26 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/27577 title Debian DSA-1395-1 : xen-utils - insecure temporary files NASL family SuSE Local Security Checks NASL id SUSE_XEN-4616.NASL description This update merges back the Xen version from SLES 10 Service Pack 1 to the 10.1 codebase, which should make it work again. Nevertheless we recommend Xen users to use the latest openSUSE release (10.3) for Xen usage. Additionaly a /tmp race was fixed (CVE-2007-3919). last seen 2020-06-01 modified 2020-06-02 plugin id 28207 published 2007-11-14 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/28207 title openSUSE 10 Security Update : xen (xen-4616) NASL family Fedora Local Security Checks NASL id FEDORA_2007-2708.NASL description - Fri Oct 26 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-8.fc7 - Fixed xenbaked tmpfile flaw (CVE-2007-3919) - Wed Sep 26 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-7.fc7 - Fixed rtl8139 checksum calculation for Vista (rhbz #308201) - Wed Sep 26 2007 Chris Lalancette <clalance at redhat.com> - 3.1.0-6.fc7 - QEmu NE2000 overflow check - CVE-2007-1321 - Pygrub guest escape - CVE-2007-4993 - Mon Sep 24 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-5.fc7 - Fix generation of manual pages (rhbz #250791) - Fix 32-on-64 PVFB for FC6 legacy guests - Mon Sep 24 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-4.fc7 - Fix VMX assist IRQ handling (rhbz #279581) - Sun Sep 23 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-3.fc7 - Don last seen 2020-06-01 modified 2020-06-02 plugin id 27794 published 2007-11-06 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27794 title Fedora 7 : xen-3.1.0-8.fc7 (2007-2708) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0194.NASL description From Red Hat Security Advisory 2008:0194 : Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 67671 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67671 title Oracle Linux 5 : xen (ELSA-2008-0194) NASL family Fedora Local Security Checks NASL id FEDORA_2007-737.NASL description - Fri Oct 26 2007 Daniel P. Berrange <berrange at redhat.com> - 3.1.0-13.fc6 - Fixed xenbaked tmpfile flaw (CVE-2007-3919) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 27636 published 2007-11-06 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27636 title Fedora Core 6 : xen-3.0.3-13.fc6 (2007-737)
Oval
accepted | 2013-04-29T04:23:17.306-04:00 | ||||||||||||
class | vulnerability | ||||||||||||
contributors |
| ||||||||||||
definition_extensions |
| ||||||||||||
description | (1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm. | ||||||||||||
family | unix | ||||||||||||
id | oval:org.mitre.oval:def:9913 | ||||||||||||
status | accepted | ||||||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||
title | (1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm. | ||||||||||||
version | 18 |
Redhat
advisories |
| ||||
rpms |
|
Statements
contributor | Mark J Cox |
lastmodified | 2007-11-01 |
organization | Red Hat |
statement | Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-3919 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447795
- http://osvdb.org/41342
- http://osvdb.org/41343
- http://secunia.com/advisories/27389
- http://secunia.com/advisories/27408
- http://secunia.com/advisories/27486
- http://secunia.com/advisories/27497
- http://secunia.com/advisories/29963
- http://www.debian.org/security/2007/dsa-1395
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:203
- http://www.redhat.com/support/errata/RHSA-2008-0194.html
- http://www.securityfocus.com/bid/26190
- http://www.securitytracker.com/id?1018859
- http://www.vupen.com/english/advisories/2007/3621
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37403
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9913
- https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00004.html
- https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00075.html