Vulnerabilities > CVE-2008-1943 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Xensource XEN

047910
CVSS 2.1 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
local
low complexity
redhat
xensource
CWE-119
nessus

Summary

Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer. Possible solution and more infomation located here: http://rhn.redhat.com/errata/RHSA-2008-0194.html

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-0194.NASL
    descriptionUpdated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor
    last seen2020-06-01
    modified2020-06-02
    plugin id43678
    published2010-01-06
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43678
    titleCentOS 5 : xen (CESA-2008:0194)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2008:0194 and 
    # CentOS Errata and Security Advisory 2008:0194 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(43678);
      script_version("1.15");
      script_cvs_date("Date: 2019/10/25 13:36:04");
    
      script_cve_id("CVE-2007-3919", "CVE-2007-5730", "CVE-2008-0928", "CVE-2008-1943", "CVE-2008-1944", "CVE-2008-2004");
      script_bugtraq_id(23731);
      script_xref(name:"RHSA", value:"2008:0194");
    
      script_name(english:"CentOS 5 : xen (CESA-2008:0194)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated xen packages that fix several security issues and a bug are
    now available for Red Hat Enterprise Linux 5.
    
    This update has been rated as having important security impact by the
    Red Hat Security Response Team.
    
    The xen packages contain tools for managing the virtual machine
    monitor in Red Hat Virtualization.
    
    These updated packages fix the following security issues :
    
    Daniel P. Berrange discovered that the hypervisor's para-virtualized
    framebuffer (PVFB) backend failed to validate the format of messages
    serving to update the contents of the framebuffer. This could allow a
    malicious user to cause a denial of service, or compromise the
    privileged domain (Dom0). (CVE-2008-1944)
    
    Markus Armbruster discovered that the hypervisor's para-virtualized
    framebuffer (PVFB) backend failed to validate the frontend's
    framebuffer description. This could allow a malicious user to cause a
    denial of service, or to use a specially crafted frontend to
    compromise the privileged domain (Dom0). (CVE-2008-1943)
    
    Chris Wright discovered a security vulnerability in the QEMU block
    format auto-detection, when running fully-virtualized guests. Such
    fully-virtualized guests, with a raw formatted disk image, were able
    to write a header to that disk image describing another format. This
    could allow such guests to read arbitrary files in their hypervisor's
    host. (CVE-2008-2004)
    
    Ian Jackson discovered a security vulnerability in the QEMU block
    device drivers backend. A guest operating system could issue a block
    device request and read or write arbitrary memory locations, which
    could lead to privilege escalation. (CVE-2008-0928)
    
    Tavis Ormandy found that QEMU did not perform adequate sanity-checking
    of data received via the 'net socket listen' option. A malicious local
    administrator of a guest domain could trigger this flaw to potentially
    execute arbitrary code outside of the domain. (CVE-2007-5730)
    
    Steve Kemp discovered that the xenbaked daemon and the XenMon utility
    communicated via an insecure temporary file. A malicious local
    administrator of a guest domain could perform a symbolic link attack,
    causing arbitrary files to be truncated. (CVE-2007-3919)
    
    As well, in the previous xen packages, it was possible for Dom0 to
    fail to flush data from a fully-virtualized guest to disk, even if the
    guest explicitly requested the flush. This could cause data integrity
    problems on the guest. In these updated packages, Dom0 always respects
    the request to flush to disk.
    
    Users of xen are advised to upgrade to these updated packages, which
    resolve these issues."
      );
      # https://lists.centos.org/pipermail/centos-announce/2008-May/014903.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b79107ec"
      );
      # https://lists.centos.org/pipermail/centos-announce/2008-May/014904.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?58bc144c"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected xen packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(59, 119, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen-libs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2007/10/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2008/05/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-5", reference:"xen-3.0.3-41.el5_1.5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"xen-devel-3.0.3-41.el5_1.5")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"xen-libs-3.0.3-41.el5_1.5")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xen / xen-devel / xen-libs");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20080513_XEN_ON_SL5_X.NASL
    descriptionNote: Troy Dawson has tested this update on a machine hosting both paravirtualized and fully virtualized machines, both 32 bit and 64 bit. He did the update while all the machines were running, none of them had any problems. He also tried stopping, starting, and rebooting several of the machines. All without any problems. We tell you this because updating the xen package, while running virtual machines, can make you a little nervous. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor
    last seen2020-06-01
    modified2020-06-02
    plugin id60398
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60398
    titleScientific Linux Security Update : xen on SL5.x i386/x86_64
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2008-2007.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2008-1945: add image format options for USB storage and removable media - CVE-2008-1952: included in fix for CVE-2008-1943 (3.1.4-0.1.3.el5)
    last seen2020-06-01
    modified2020-06-02
    plugin id79449
    published2014-11-26
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/79449
    titleOracleVM 2.1 : xen (OVMSA-2008-2007)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0194.NASL
    descriptionUpdated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor
    last seen2020-06-01
    modified2020-06-02
    plugin id32354
    published2008-05-16
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/32354
    titleRHEL 5 : xen (RHSA-2008:0194)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-0194.NASL
    descriptionFrom Red Hat Security Advisory 2008:0194 : Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor
    last seen2020-06-01
    modified2020-06-02
    plugin id67671
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67671
    titleOracle Linux 5 : xen (ELSA-2008-0194)

Oval

accepted2013-04-29T04:04:47.832-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
    ovaloval:org.mitre.oval:def:11414
  • commentThe operating system installed on the system is CentOS Linux 5.x
    ovaloval:org.mitre.oval:def:15802
  • commentOracle Linux 5.x
    ovaloval:org.mitre.oval:def:15459
descriptionBuffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.
familyunix
idoval:org.mitre.oval:def:10338
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleBuffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.
version18

Redhat

advisories
rhsa
idRHSA-2008:0194
rpms
  • xen-0:3.0.3-41.el5_1.5
  • xen-debuginfo-0:3.0.3-41.el5_1.5
  • xen-devel-0:3.0.3-41.el5_1.5
  • xen-libs-0:3.0.3-41.el5_1.5

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 29183 CVE(CAN) ID: CVE-2008-1943 Xen是可用于Linux内核的一种虚拟化技术,允许同时运行多个操作系统。 Xen中超虚拟化帧缓冲区(PVFB)后端没有验证前端的帧缓冲区描述,这可能允许恶意用户导致拒绝服务或使用特制的前端入侵特权域Dom0。 帧缓冲区是由以下参数描述的: * fb_len(共享帧缓冲区大小) * width,height,depth * row_stride,offset 在启动时fb_len是固定大小,前端可以通过发送XENFB_TYPE_RESIZE事件修改其他参数。如果存在后端配置参数videoram的话,xenfb_read_frontend_fb_config()会根据这个参数限制fb_len。xenfb_map_fb()使用fb_len映射前端的帧缓冲区,除非有videoram参数的限制,否则前端就可以使该函数映射任意大小。 xenfb_register_console()和xenfb_on_fb_event()向QEMU的DisplayState对象传送width、height、depth和rowstride参数。如果参数允许的话,DisplayState对象直接操作帧缓冲区(shared_buf为true),否则分配大小为height * width * depth/8的内部缓冲区(shared_buf为false)。 xenfb_on_fb_event()使用width和height参数确定升级事件的区域,然后将该区域传送给xenfb_guest_copy();xenfb_invalidate()将完整的屏幕区域传送给xenfb_guest_copy();除非shared_buf为true,否则xenfb_guest_copy()将参数区域(x,y,w,h)拷贝到内部缓冲区,这会拷贝h块内存;从0开始计算的第i次拷贝将共享帧缓冲区的w * depth/8字节 + offset + (y + i) * row_stride + x * depth/8拷贝到了内部缓冲区 + (y + i) * ds-&gt;linesize + x * ds-&gt;depth/8。(这里ds-&gt;linesize和ds-&gt;depth是后端所指定的内部缓冲区) 上述拷贝操作会导致读取读取共享的帧缓冲区并越界写入到内部缓冲区。前端可以利用这个漏洞写入到任意后端内存,导致拒绝服务或入侵特权域。 XenSource Xen 3.2.1 RedHat ------ RedHat已经为此发布了一个安全公告(RHSA-2008:0194-01)以及相应补丁: RHSA-2008:0194-01:Important: xen security and bug fix update 链接:<a href=https://www.redhat.com/support/errata/RHSA-2008-0194.html target=_blank>https://www.redhat.com/support/errata/RHSA-2008-0194.html</a> 补丁下载: XenSource --------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://xenbits.xensource.com/xen-unstable.hg?diff/53195719f762/tools/ioemu/hw/xenfb.c target=_blank>http://xenbits.xensource.com/xen-unstable.hg?diff/53195719f762/tools/ioemu/hw/xenfb.c</a> <a href=http://xenbits.xensource.com/xen-unstable.hg?diff/9044705960cb/tools/ioemu/hw/xenfb.c target=_blank>http://xenbits.xensource.com/xen-unstable.hg?diff/9044705960cb/tools/ioemu/hw/xenfb.c</a>
idSSV:3473
last seen2017-11-19
modified2008-06-25
published2008-06-25
reporterRoot
titleXen超虚拟化帧缓冲区后端帧缓冲区处理漏洞