RedHat: Important: xen security update
Summary
Summary
The Xen package contains the tools for managing the virtual machine monitor in Red Hat Enterprise Linux virtualization. The following security flaws are fixed in the updated Xen package: Joris van Rantwijk found a flaw in the Pygrub utility which is used as a boot loader for guest domains. A malicious local administrator of a guest domain could create a carefully crafted grub.conf file which would trigger the execution of arbitrary code outside of that domain. (CVE-2007-4993) Tavis Ormandy discovered a heap overflow flaw during video-to-video copy operations in the Cirrus VGA extension code used in Xen. A malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain. (CVE-2007-1320) Tavis Ormandy discovered insufficient input validation leading to a heap overflow in the Xen NE2000 network driver. If the driver is in use, a malicious local administrator of a guest domain could potentially trigger this flaw and execute arbitrary code outside of the domain. Xen does not use this driver by default. (CVE-2007-1321) Users of Xen should update to these erratum packages containing backported patches which correct these issues.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
5. Bug IDs fixed (http://bugzilla.redhat.com/):
237342 - CVE-2007-1320 xen Cirrus LGD-54XX "bitblt" Heap Overflow
237343 - CVE-2007-1321 xen QEMU NE2000 emulation issues
302801 - CVE-2007-4993 xen guest root can escape to domain 0 through pygrub
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
x86_64:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
RHEL Desktop Multi OS (v. 5 client):
SRPMS:
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
f41141cc620e161fedd68456d91c0103 xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
x86_64:
8821c1ad48035acc660ec5b1df3a1cb1 xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
ia64:
97d55e42bdc3fa09378f240db42d8dcb xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
09a0ab57a37644e796eb9d13efac90cb xen-libs-3.0.3-25.0.4.el5.ia64.rpm
x86_64:
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
e4dca4285b1c8fd877527ec278e9d835 xen-libs-3.0.3-25.0.4.el5.i386.rpm
8869650a19cb4001e7aa1d1fa1dc562f xen-libs-3.0.3-25.0.4.el5.x86_64.rpm
RHEL Virtualization (v. 5 server):
SRPMS:
226cf2369c7df9af07a8494f310680dc xen-3.0.3-25.0.4.el5.src.rpm
i386:
f41141cc620e161fedd68456d91c0103 xen-3.0.3-25.0.4.el5.i386.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
ia64:
aae6a104ac9d96a2258083a2037091e7 xen-3.0.3-25.0.4.el5.ia64.rpm
97d55e42bdc3fa09378f240db42d8dcb xen-debuginfo-3.0.3-25.0.4.el5.ia64.rpm
fbf21cbabba81747c23c9462a88e934b xen-devel-3.0.3-25.0.4.el5.ia64.rpm
x86_64:
8821c1ad48035acc660ec5b1df3a1cb1 xen-3.0.3-25.0.4.el5.x86_64.rpm
e00efb4070466dc19899057695469862 xen-debuginfo-3.0.3-25.0.4.el5.i386.rpm
e767f1732863dfa85c0b1878d63b3e51 xen-debuginfo-3.0.3-25.0.4.el5.x86_64.rpm
29bcc93687b19f3388db33fbc7967466 xen-devel-3.0.3-25.0.4.el5.i386.rpm
29ef0e6e5097bd82e44d8492bb8cfe5f xen-devel-3.0.3-25.0.4.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1320 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1321 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4993 http://www.redhat.com/security/updates/classification/#important
Package List
Topic
Topic
Relevant Releases Architectures
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Multi OS (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64
RHEL Virtualization (v. 5 server) - i386, ia64, x86_64
Bugs Fixed