RHSA-2007:0323 - Security Advisory

Topic

An updated Xen package to fix multiple security issues is now available for
Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The Xen package contains the tools for managing the virtual machine monitor
in Red Hat Enterprise Linux virtualization.

The following security flaws are fixed in the updated Xen package:

Joris van Rantwijk found a flaw in the Pygrub utility which is used as a
boot loader for guest domains. A malicious local administrator of a guest
domain could create a carefully crafted grub.conf file which would trigger
the execution of arbitrary code outside of that domain. (CVE-2007-4993)

Tavis Ormandy discovered a heap overflow flaw during video-to-video copy
operations in the Cirrus VGA extension code used in Xen. A malicious local
administrator of a guest domain could potentially trigger this flaw and
execute arbitrary code outside of the domain. (CVE-2007-1320)

Tavis Ormandy discovered insufficient input validation leading to a heap
overflow in the Xen NE2000 network driver. If the driver is in use, a
malicious local administrator of a guest domain could potentially trigger
this flaw and execute arbitrary code outside of the domain. Xen does not
use this driver by default. (CVE-2007-1321)

Users of Xen should update to these erratum packages containing backported
patches which correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 237342 - CVE-2007-1320 xen Cirrus LGD-54XX "bitblt" Heap Overflow
• BZ - 237343 - CVE-2007-1321 xen QEMU NE2000 emulation issues
• BZ - 302801 - CVE-2007-4993 xen guest root can escape to domain 0 through pygrub

CVEs

• CVE-2007-4993
• CVE-2007-1320
• CVE-2007-1321

References

• http://www.redhat.com/security/updates/classification/#important