Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2013.0557 xen security update 19 April 2013 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: xen Publisher: Debian Operating System: Debian GNU/Linux 6 UNIX variants (UNIX, Linux, OSX) Impact/Access: Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2013-1919 CVE-2013-1917 Original Bulletin: http://www.debian.org/security/2013/dsa-2662 Comment: This advisory references vulnerabilities in products which run on platforms other than Debian. It is recommended that administrators running xen check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-2662-1 security@debian.org http://www.debian.org/security/ Salvatore Bonaccorso April 18, 2013 http://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : xen Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-1917 CVE-2013-1919 Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1917 The SYSENTER instruction can be used by PV guests to accelerate system call processing. This instruction, however, leaves the EFLAGS register mostly unmodified. This can be used by malicious or buggy user space to cause the entire host to crash. CVE-2013-1919 Various IRQ related access control operations may not have the intended effect, potentially permitting a stub domain to grant its client domain access to an IRQ it doesn't have access to itself. This can be used by malicious or buggy stub domains kernels to mount a denial of service attack possibly affecting the whole system. For the stable distribution (squeeze), these problems have been fixed in version 4.0.1-5.9. For the testing distribution (wheezy) and the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your xen packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJRcAS2AAoJEL97/wQC1SS+Iv8H/jgF59tOvl0f5ybpS1nOjnim ISDrxnkODEyfDlA9org+o1M61gTPyU8bT0QvjjUfeVKh5y0FewmrVoFYdlE9slI2 Q4vOwf4paQd0D/VcQWVLnTRNoHALIFq/V3WXgpo7Fk7ffXZkjQgdOE7MviX8SfLh gvl6hobIuVeEiDMWROkESpim5UjxX5Xh6X4g9C1a3o82nCxKyv55/SWz4lpCqbxV CNyKt3Qo6IdbHkKVFSasYZhb1oPtiGAMuIFyOhmRXmpZRSyfomuJI4HJlUgs0rZ3 j4ki0LjETq3DfwY5eP2gDPaE2aPc5TgUJC9kmOtUviRFIAWjU0LFwN/y3hZVRVg= =7t1v - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUXCQ++4yVqjM2NGpAQKPMQ/+IhVlms1vMR0I73ASNXW698RvFWRINZmX hRSCKGSbHW6V23OdGyiKfk31ERtmsEwehPzOZ6dkSvqO0MUpgR6GCGntO2Zq6Y4S Da11hgJbP9/evkAab5WWnphX5wMtUXsFSG6EQMhQgOdZhux8UrBUri1j0PK10Y0c ulak0CBJz7EP4pFj5/j6WJQZLrfx6Nd1eO4YYz/7r71jdpmObjp1Kkmp/ikaJ7cg u0n6/5KveaZh9KVlPHTGz/P3MxNkBk1Tj6wBEOCjQhmv4Msk5Q1kAp3CJNkwX/K4 LPKodcpjflQUQ/WRXN1SPpNXv6eXPERx2Mjk3CMU6bNwi+sRL8DwNmGoFrlkUEuM oYzmPMUFRte+nNXx9UNe0ttaIxRr13/+TbG2ZwEkArpqB3JQdgS7/VhAGqd3P2hV B596qhDxTzzWq7emmXHZjkuo9mHOWAjZQ5cRFW/7uygd0q5/1d9R9tx7SZ64itxT JnXAD0pgFcB5u1YJHGD2vj8n9cYLSReKXwV+xFqMrcf/YQMtLZ80roygG6la2Lxa 7IUtdjSktnRcD3uGt/OIMQvrY4N4My5PfkadIM05XYcPeCDM0o5T20utawAH06d3 hvXebdeXFPXLeQa/DyzcjA5KfiIHFmu+HzcyXQ1sCQA5CYVMow0V88iYrZLU+iYC uHTDm49USEI= =GUIm -----END PGP SIGNATURE-----