Missing privilege level checks in x86 emulation of far branches
2014-11-18T12:00:00
ID XSA-110 Type xen Reporter Xen Project Modified 2014-11-18T12:23:00
Description
ISSUE DESCRIPTION
The emulation of far branch instructions (CALL, JMP, and RETF in Intel assembly syntax, LCALL, LJMP, and LRET in AT&T assembly syntax) incompletely performs privilege checks.
However these instructions are not usually handled by the emulator. Exceptions to this are
- when a memory operand lives in (emulated or passed through) memory mapped IO space,
- in the case of guests running in 32-bit PAE mode, when such an instruction is (in execution flow) within four instructions of one doing a page table update,
- when an Invalid Opcode exception gets raised by a guest instruction, and the guest then (likely maliciously) alters the instruction to become one of the affected ones,
- when the guest is in real mode (in which case there are no privilege checks anyway).
IMPACT
Malicious HVM guest user mode code may be able to elevate its privileges to guest supervisor mode, or to crash the guest.
VULNERABLE SYSTEMS
Xen 3.2.1 and onward are vulnerable on x86 systems.
ARM systems are not vulnerable.
Only user processes in x86 HVM guests can take advantage of this vulnerability.
{"enchantments": {"score": {"value": 4.6, "vector": "NONE", "modified": "2016-09-04T11:24:07", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-8595"]}, {"type": "nessus", "idList": ["ORACLEVM_OVMSA-2015-0096.NASL", "ORACLEVM_OVMSA-2015-0004.NASL", "FEDORA_2014-15503.NASL", "SUSE_SU-2014-1732-1.NASL", "SUSE_11_XEN-11SP3-2014-11-26-141127.NASL", "CITRIX_XENSERVER_CTX200288.NASL", "DEBIAN_DSA-3140.NASL", "SUSE_SU-2014-1691-1.NASL", "FEDORA_2014-15521.NASL", "FEDORA_2014-15951.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310869232", "OPENVAS:1361412562310703140", "OPENVAS:1361412562310850634", "OPENVAS:1361412562310868797", "OPENVAS:1361412562310105147", "OPENVAS:1361412562310850677", "OPENVAS:703140", "OPENVAS:1361412562310868930", "OPENVAS:1361412562310869121", "OPENVAS:1361412562310851016"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3140-1:0F141"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:31685"]}, {"type": "fedora", "idList": ["FEDORA:684B76087C09", "FEDORA:DD565608792C", "FEDORA:1F082605DFF5", "FEDORA:563A36087B2E", "FEDORA:5F8A86077990", "FEDORA:299546076F66", "FEDORA:D3AC8608A1F3", "FEDORA:787C96087980", "FEDORA:DEF6E60C424A", "FEDORA:03EEF60499DD"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2015:0226-1", "SUSE-SU-2015:0022-1", "OPENSUSE-SU-2015:0256-1"]}, {"type": "gentoo", "idList": ["GLSA-201504-04"]}], "modified": "2016-09-04T11:24:07", "rev": 2}, "vulnersScore": 4.6}, "published": "2014-11-18T12:00:00", "id": "XSA-110", "modified": "2014-11-18T12:23:00", "edition": 1, "reporter": "Xen Project", "description": "#### ISSUE DESCRIPTION\nThe emulation of far branch instructions (CALL, JMP, and RETF in Intel assembly syntax, LCALL, LJMP, and LRET in AT&T assembly syntax) incompletely performs privilege checks.\nHowever these instructions are not usually handled by the emulator. Exceptions to this are\n- when a memory operand lives in (emulated or passed through) memory mapped IO space,\n- in the case of guests running in 32-bit PAE mode, when such an instruction is (in execution flow) within four instructions of one doing a page table update,\n- when an Invalid Opcode exception gets raised by a guest instruction, and the guest then (likely maliciously) alters the instruction to become one of the affected ones,\n- when the guest is in real mode (in which case there are no privilege checks anyway).\n#### IMPACT\nMalicious HVM guest user mode code may be able to elevate its privileges to guest supervisor mode, or to crash the guest.\n#### VULNERABLE SYSTEMS\nXen 3.2.1 and onward are vulnerable on x86 systems.\nARM systems are not vulnerable.\nOnly user processes in x86 HVM guests can take advantage of this vulnerability.\n", "bulletinFamily": "software", "viewCount": 13, "cvelist": ["CVE-2014-8595"], "affectedSoftware": [{"version": "3.2.1", "name": "Xen", "operator": "ge"}], "type": "xen", "references": [], "title": "Missing privilege level checks in x86 emulation of far branches", "href": "http://xenbits.xen.org/xsa/advisory-110.html", "lastseen": "2016-09-04T11:24:07", "cvss": {"score": 1.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}
{"cve": [{"lastseen": "2020-10-03T12:01:22", "description": "arch/x86/x86_emulate/x86_emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service (crash) via a crafted (1) CALL, (2) JMP, (3) RETF, (4) LCALL, (5) LJMP, or (6) LRET far branch instruction.", "edition": 3, "cvss3": {}, "published": "2014-11-19T18:59:00", "title": "CVE-2014-8595", "type": "cve", "cwe": ["CWE-17"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 1.9, "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8595"], "modified": "2018-10-30T16:27:00", "cpe": ["cpe:/o:xen:xen:4.1.1", "cpe:/o:xen:xen:4.4.0", "cpe:/o:xen:xen:3.4.4", "cpe:/o:xen:xen:4.0.3", "cpe:/o:xen:xen:4.3.0", "cpe:/o:xen:xen:4.0.4", "cpe:/o:xen:xen:3.4.0", "cpe:/o:opensuse:opensuse:13.1", "cpe:/o:xen:xen:4.1.5", "cpe:/o:xen:xen:4.2.0", "cpe:/o:xen:xen:4.1.4", "cpe:/o:xen:xen:4.0.1", "cpe:/o:xen:xen:4.2.3", "cpe:/o:xen:xen:3.2.3", "cpe:/o:xen:xen:4.2.1", "cpe:/o:xen:xen:4.0.2", "cpe:/o:xen:xen:4.1.0", "cpe:/o:xen:xen:4.1.6.1", "cpe:/o:xen:xen:4.2.2", "cpe:/o:opensuse:opensuse:13.2", "cpe:/o:xen:xen:3.3.0", "cpe:/o:xen:xen:4.1.3", "cpe:/o:xen:xen:4.0.0", "cpe:/o:xen:xen:3.4.1", "cpe:/o:xen:xen:4.3.1", "cpe:/o:xen:xen:3.3.1", "cpe:/o:xen:xen:3.3.2", "cpe:/o:debian:debian_linux:7.0", "cpe:/o:xen:xen:4.1.2", "cpe:/o:xen:xen:3.4.3", "cpe:/o:xen:xen:3.2.2", "cpe:/o:xen:xen:3.4.2", "cpe:/o:xen:xen:3.2.1"], "id": "CVE-2014-8595", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8595", "cvss": {"score": 1.9, "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:xen:xen:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.1.4:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.1.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.1.5:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:xen:xen:3.3.1:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2021-01-06T13:23:34", "description": "The remote OracleVM system is missing necessary patches to address\ncritical security updates : please see Oracle VM Security Advisory\nOVMSA-2015-0096 for details.", "edition": 26, "published": "2015-07-28T00:00:00", "title": "OracleVM 3.2 : xen (OVMSA-2015-0096)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8595", "CVE-2015-5154", "CVE-2015-2152"], "modified": "2015-07-28T00:00:00", "cpe": ["p-cpe:/a:oracle:vm:xen-devel", "cpe:/o:oracle:vm_server:3.2", "p-cpe:/a:oracle:vm:xen", "p-cpe:/a:oracle:vm:xen-tools"], "id": "ORACLEVM_OVMSA-2015-0096.NASL", "href": "https://www.tenable.com/plugins/nessus/85038", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2015-0096.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(85038);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2014-8595\", \"CVE-2015-2152\", \"CVE-2015-5154\");\n script_bugtraq_id(71151, 73068);\n\n script_name(english:\"OracleVM 3.2 : xen (OVMSA-2015-0096)\");\n script_summary(english:\"Checks the RPM output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates : please see Oracle VM Security Advisory\nOVMSA-2015-0096 for details.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/oraclevm-errata/2015-July/000344.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected xen / xen-devel / xen-tools packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/07/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/07/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.2\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.2\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.2\", reference:\"xen-4.1.3-25.el5.127.60\")) flag++;\nif (rpm_check(release:\"OVS3.2\", reference:\"xen-devel-4.1.3-25.el5.127.60\")) flag++;\nif (rpm_check(release:\"OVS3.2\", reference:\"xen-tools-4.1.3-25.el5.127.60\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen / xen-devel / xen-tools\");\n}\n", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T01:33:47", "description": "The remote host is running a version of Citrix XenServer that is\naffected by multiple vulnerabilities :\n\n - A local privilege escalation vulnerability exists\n due to improperly restricted access to\n 'PHYSDEVOP_{prepare,release}_msix' operations by\n unprivileged guests. An attacker with access to a guest\n operating system can exploit this issue to gain elevated\n privileges on affected computers. (CVE-2014-1666)\n\n - A local privilege escalation vulnerability exists\n due to missing privilege level checks in x86 emulation\n of far branches. This flaw exists in the CALL, JMP, and\n RETF instructions in the Intel assembly syntax, and the\n LCALL, LJMP, and LRET instructions in the AT&T syntax.\n An attacker with access to a guest operating system can\n exploit this issue to gain elevated privileges on\n affected computers. (CVE-2014-8595)\n\n - A denial of service vulnerability exists due to a\n failure to restrict access to the hypercall argument\n translation feature. An attacker with access to a guest\n operating system can crash the host with excessive\n checks on the final register state for 32-bit guests\n running on a 64-bit hypervisor. (CVE-2014-8866)\n\n - A denial of service vulnerability exists due to\n insufficient bounding of 'REP MOVS' to MMIO emulated\n inside of the hypervisor. This flaw affects the\n 'hvm_mmio_intercept()' function in 'intercept.c'. An\n attacker with access to a guest operating system can\n exploit this issue to crash the host.\n (CVE-2014-8867)", "edition": 28, "cvss3": {"score": 9.0, "vector": "AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "published": "2014-12-05T00:00:00", "title": "Citrix XenServer Multiple Vulnerabilities (CTX200288)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-1666"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/a:citrix:xenserver"], "id": "CITRIX_XENSERVER_CTX200288.NASL", "href": "https://www.tenable.com/plugins/nessus/79745", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(79745);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/11/25\");\n\n script_cve_id(\n \"CVE-2014-1666\",\n \"CVE-2014-8595\",\n \"CVE-2014-8866\",\n \"CVE-2014-8867\"\n );\n script_bugtraq_id(\n 65125,\n 71151,\n 71331,\n 71332\n );\n\n script_name(english:\"Citrix XenServer Multiple Vulnerabilities (CTX200288)\");\n script_summary(english:\"Checks XenServer version and installed hotfixes.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is missing a vendor-supplied security patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Citrix XenServer that is\naffected by multiple vulnerabilities :\n\n - A local privilege escalation vulnerability exists\n due to improperly restricted access to\n 'PHYSDEVOP_{prepare,release}_msix' operations by\n unprivileged guests. An attacker with access to a guest\n operating system can exploit this issue to gain elevated\n privileges on affected computers. (CVE-2014-1666)\n\n - A local privilege escalation vulnerability exists\n due to missing privilege level checks in x86 emulation\n of far branches. This flaw exists in the CALL, JMP, and\n RETF instructions in the Intel assembly syntax, and the\n LCALL, LJMP, and LRET instructions in the AT&T syntax.\n An attacker with access to a guest operating system can\n exploit this issue to gain elevated privileges on\n affected computers. (CVE-2014-8595)\n\n - A denial of service vulnerability exists due to a\n failure to restrict access to the hypercall argument\n translation feature. An attacker with access to a guest\n operating system can crash the host with excessive\n checks on the final register state for 32-bit guests\n running on a 64-bit hypervisor. (CVE-2014-8866)\n\n - A denial of service vulnerability exists due to\n insufficient bounding of 'REP MOVS' to MMIO emulated\n inside of the hypervisor. This flaw affects the\n 'hvm_mmio_intercept()' function in 'intercept.c'. An\n attacker with access to a guest operating system can\n exploit this issue to crash the host.\n (CVE-2014-8867)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.citrix.com/article/CTX200288\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the relevant hotfix referenced in the vendor advisory.\");\n script_set_cvss_base_vector(\"CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2014-1666\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/11/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/12/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:citrix:xenserver\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"citrix_xenserver_version.nbin\");\n script_require_keys(\"Host/XenServer/version\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\napp_name = \"Citrix XenServer\";\nversion = get_kb_item_or_exit(\"Host/XenServer/version\");\nget_kb_item_or_exit(\"Host/local_checks_enabled\");\npatches = get_kb_item(\"Host/XenServer/patches\");\nvuln = FALSE;\nfix = '';\n\n# We will do our checks within the branches because 6.0.2 needs\n# special treatment.\nif (version == \"6.0.0\")\n{\n fix = \"XS60E042\";\n if (\"XS60E042\" >!< patches) vuln = TRUE;\n}\nelse if (version == \"6.0.2\")\n{\n fix = \"XS602E038 or XS602ECC014\";\n if (\"XS602E038\" >!< patches && \"XS602ECC014\" >!< patches) vuln = TRUE;\n}\nelse if (version =~ \"^6\\.1\\.\")\n{\n fix = \"XS61E045\";\n if (\"XS61E045\" >!< patches) vuln = TRUE;\n}\nelse if (version =~ \"^6\\.2\\.\")\n{\n fix = \"XS62ESP1015\";\n if (\"XS62ESP1015\" >!< patches) vuln = TRUE;\n}\nelse audit(AUDIT_INST_VER_NOT_VULN, app_name, version);\n\nif (vuln)\n{\n port = 0;\n report =\n '\\n Installed version : ' + version +\n '\\n Missing hotfix : ' + fix +\n '\\n';\n\n security_report_v4(severity:SECURITY_HOLE, extra:report, port:port);\n}\nelse audit(AUDIT_PATCH_INSTALLED, fix);\n", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T10:12:18", "description": "Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling\nInsufficient restrictions on certain MMU update hypercalls, Missing\nprivilege level checks in x86 emulation of far branches, Add fix for\nCVE-2014-0150 to qemu-dm, though it probably isn't exploitable from\nxen\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 14, "published": "2014-12-02T00:00:00", "title": "Fedora 19 : xen-4.2.5-5.fc19 (2014-15503)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8595", "CVE-2014-8594", "CVE-2014-0150", "CVE-2014-9030"], "modified": "2014-12-02T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:19", "p-cpe:/a:fedoraproject:fedora:xen"], "id": "FEDORA_2014-15503.NASL", "href": "https://www.tenable.com/plugins/nessus/79651", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-15503.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(79651);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-0150\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-9030\");\n script_bugtraq_id(66821, 71149, 71151, 71207);\n script_xref(name:\"FEDORA\", value:\"2014-15503\");\n\n script_name(english:\"Fedora 19 : xen-4.2.5-5.fc19 (2014-15503)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling\nInsufficient restrictions on certain MMU update hypercalls, Missing\nprivilege level checks in x86 emulation of far branches, Add fix for\nCVE-2014-0150 to qemu-dm, though it probably isn't exploitable from\nxen\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1078846\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1160643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1160664\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1166913\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145039.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b98d4e84\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/12/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"xen-4.2.5-5.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-12T10:12:20", "description": "Excessive checking in compatibility mode hypercall argument\ntranslation, Insufficient bounding of 'REP MOVS' to MMIO emulated\ninside the hypervisor, fix segfaults and failures in xl migrate\n--debug Guest effectable page reference leak in MMU_MACHPHYS_UPDATE\nhandling Insufficient restrictions on certain MMU update hypercalls,\nMissing privilege level checks in x86 emulation of far branches, Add\nfix for CVE-2014-0150 to qemu-dm, though it probably isn't exploitable\nfrom xen\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 14, "published": "2014-12-15T00:00:00", "title": "Fedora 21 : xen-4.4.1-9.fc21 (2014-15951)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8595", "CVE-2014-8594", "CVE-2014-0150", "CVE-2014-9030"], "modified": "2014-12-15T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:21", "p-cpe:/a:fedoraproject:fedora:xen"], "id": "FEDORA_2014-15951.NASL", "href": "https://www.tenable.com/plugins/nessus/79902", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-15951.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(79902);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-0150\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-9030\");\n script_bugtraq_id(66821, 71149, 71151, 71207);\n script_xref(name:\"FEDORA\", value:\"2014-15951\");\n\n script_name(english:\"Fedora 21 : xen-4.4.1-9.fc21 (2014-15951)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Excessive checking in compatibility mode hypercall argument\ntranslation, Insufficient bounding of 'REP MOVS' to MMIO emulated\ninside the hypervisor, fix segfaults and failures in xl migrate\n--debug Guest effectable page reference leak in MMU_MACHPHYS_UPDATE\nhandling Insufficient restrictions on certain MMU update hypercalls,\nMissing privilege level checks in x86 emulation of far branches, Add\nfix for CVE-2014-0150 to qemu-dm, though it probably isn't exploitable\nfrom xen\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1078846\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1160643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1160664\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1166913\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145761.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?16c89703\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:21\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/12/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^21([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 21.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC21\", reference:\"xen-4.4.1-9.fc21\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-12T10:12:19", "description": "Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling\nInsufficient restrictions on certain MMU update hypercalls, Missing\nprivilege level checks in x86 emulation of far branches, Add fix for\nCVE-2014-0150 to qemu-dm, though it probably isn't exploitable from\nxen\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 14, "published": "2014-12-02T00:00:00", "title": "Fedora 20 : xen-4.3.3-5.fc20 (2014-15521)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8595", "CVE-2014-8594", "CVE-2014-0150", "CVE-2014-9030"], "modified": "2014-12-02T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:xen", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-15521.NASL", "href": "https://www.tenable.com/plugins/nessus/79652", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-15521.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(79652);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-0150\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-9030\");\n script_bugtraq_id(66821, 71149, 71151);\n script_xref(name:\"FEDORA\", value:\"2014-15521\");\n\n script_name(english:\"Fedora 20 : xen-4.3.3-5.fc20 (2014-15521)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling\nInsufficient restrictions on certain MMU update hypercalls, Missing\nprivilege level checks in x86 emulation of far branches, Add fix for\nCVE-2014-0150 to qemu-dm, though it probably isn't exploitable from\nxen\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1078846\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1160643\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1160664\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1166913\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145040.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fc3b4fd8\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected xen package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/12/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"xen-4.3.3-5.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-12T09:48:56", "description": "Multiple security issues have been discovered in the Xen\nvirtualisation solution which may result in denial of service,\ninformation disclosure or privilege escalation.\n\n - CVE-2014-8594\n Roger Pau Monne and Jan Beulich discovered that\n incomplete restrictions on MMU update hypercalls may\n result in privilege escalation.\n\n - CVE-2014-8595\n Jan Beulich discovered that missing privilege level\n checks in the x86 emulation of far branches may result\n in privilege escalation.\n\n - CVE-2014-8866\n Jan Beulich discovered that an error in compatibility\n mode hypercall argument translation may result in denial\n of service.\n\n - CVE-2014-8867\n Jan Beulich discovered that an insufficient restriction\n in acceleration support for the 'REP MOVS' instruction\n may result in denial of service.\n\n - CVE-2014-9030\n Andrew Cooper discovered a page reference leak in\n MMU_MACHPHYS_UPDATE handling, resulting in denial of\n service.", "edition": 16, "published": "2015-01-28T00:00:00", "title": "Debian DSA-3140-1 : xen - security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-9030"], "modified": "2015-01-28T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:xen", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-3140.NASL", "href": "https://www.tenable.com/plugins/nessus/81027", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3140. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(81027);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9030\");\n script_bugtraq_id(71149, 71151, 71207, 71331, 71332);\n script_xref(name:\"DSA\", value:\"3140\");\n\n script_name(english:\"Debian DSA-3140-1 : xen - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security issues have been discovered in the Xen\nvirtualisation solution which may result in denial of service,\ninformation disclosure or privilege escalation.\n\n - CVE-2014-8594\n Roger Pau Monne and Jan Beulich discovered that\n incomplete restrictions on MMU update hypercalls may\n result in privilege escalation.\n\n - CVE-2014-8595\n Jan Beulich discovered that missing privilege level\n checks in the x86 emulation of far branches may result\n in privilege escalation.\n\n - CVE-2014-8866\n Jan Beulich discovered that an error in compatibility\n mode hypercall argument translation may result in denial\n of service.\n\n - CVE-2014-8867\n Jan Beulich discovered that an insufficient restriction\n in acceleration support for the 'REP MOVS' instruction\n may result in denial of service.\n\n - CVE-2014-9030\n Andrew Cooper discovered a page reference leak in\n MMU_MACHPHYS_UPDATE handling, resulting in denial of\n service.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2014-8594\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2014-8595\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2014-8866\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2014-8867\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2014-9030\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/xen\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2015/dsa-3140\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the xen packages.\n\nFor the stable distribution (wheezy), these problems have been fixed\nin version 4.1.4-3+deb7u4.\n\nFor the upcoming stable distribution (jessie), these problems have\nbeen fixed in version 4.4.1-4.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"libxen-4.1\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libxen-dev\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libxen-ocaml\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libxen-ocaml-dev\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libxenstore3.0\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xen-docs-4.1\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xen-hypervisor-4.1-amd64\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xen-hypervisor-4.1-i386\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xen-system-amd64\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xen-system-i386\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xen-utils-4.1\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xen-utils-common\", reference:\"4.1.4-3+deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"xenstore-utils\", reference:\"4.1.4-3+deb7u4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-20T14:42:00", "description": "Xen has been updated to version 4.2.5 with additional patches to fix\nsix security issues :\n\n - Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling. (CVE-2014-9030)\n\n - Insufficient bounding of 'REP MOVS' to MMIO emulated\n inside the hypervisor. (CVE-2014-8867)\n\n - Excessive checking in compatibility mode hypercall\n argument translation. (CVE-2014-8866)\n\n - Guest user mode triggerable VM exits not handled by\n hypervisor. (bnc#903850)\n\n - Missing privilege level checks in x86 emulation of far\n branches. (CVE-2014-8595)\n\n - Insufficient restrictions on certain MMU update\n hypercalls (CVE-2014-8594). These non-security issues\n have been fixed :\n\n - Xen save/restore of HVM guests cuts off disk and\n networking. (bnc#866902)\n\n - Windows 2012 R2 fails to boot up with greater than 60\n vcpus. (bnc#882089)\n\n - Increase limit domUloader to 32MB. (bnc#901317)\n\n - Adjust xentop column layout. (bnc#896023)", "edition": 18, "published": "2014-12-26T00:00:00", "title": "SuSE 11.3 Security Update : Xen (SAT Patch Number 10018)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-9030"], "modified": "2014-12-26T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:11:xen-tools", "p-cpe:/a:novell:suse_linux:11:xen-tools-domU", "p-cpe:/a:novell:suse_linux:11:xen-libs-32bit", "cpe:/o:novell:suse_linux:11", "p-cpe:/a:novell:suse_linux:11:xen", "p-cpe:/a:novell:suse_linux:11:xen-doc-pdf", "p-cpe:/a:novell:suse_linux:11:xen-doc-html", "p-cpe:/a:novell:suse_linux:11:xen-libs", "p-cpe:/a:novell:suse_linux:11:xen-kmp-default"], "id": "SUSE_11_XEN-11SP3-2014-11-26-141127.NASL", "href": "https://www.tenable.com/plugins/nessus/80254", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from SuSE 11 update information. The text itself is\n# copyright (C) Novell, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80254);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9030\");\n\n script_name(english:\"SuSE 11.3 Security Update : Xen (SAT Patch Number 10018)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 11 host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Xen has been updated to version 4.2.5 with additional patches to fix\nsix security issues :\n\n - Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling. (CVE-2014-9030)\n\n - Insufficient bounding of 'REP MOVS' to MMIO emulated\n inside the hypervisor. (CVE-2014-8867)\n\n - Excessive checking in compatibility mode hypercall\n argument translation. (CVE-2014-8866)\n\n - Guest user mode triggerable VM exits not handled by\n hypervisor. (bnc#903850)\n\n - Missing privilege level checks in x86 emulation of far\n branches. (CVE-2014-8595)\n\n - Insufficient restrictions on certain MMU update\n hypercalls (CVE-2014-8594). These non-security issues\n have been fixed :\n\n - Xen save/restore of HVM guests cuts off disk and\n networking. (bnc#866902)\n\n - Windows 2012 R2 fails to boot up with greater than 60\n vcpus. (bnc#882089)\n\n - Increase limit domUloader to 32MB. (bnc#901317)\n\n - Adjust xentop column layout. (bnc#896023)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=866902\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=882089\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=896023\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=901317\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=903850\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=903967\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=903970\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=905465\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=905467\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=906439\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2014-8594.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2014-8595.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2014-8866.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2014-8867.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2014-9030.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply SAT patch number 10018.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen-doc-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen-libs-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/12/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)11\") audit(AUDIT_OS_NOT, \"SuSE 11\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SuSE 11\", cpu);\n\npl = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(pl) || int(pl) != 3) audit(AUDIT_OS_NOT, \"SuSE 11.3\");\n\n\nflag = 0;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-doc-html-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-doc-pdf-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-kmp-default-4.2.5_02_3.0.101_0.40-0.7.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-libs-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-libs-32bit-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-tools-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:3, cpu:\"x86_64\", reference:\"xen-tools-domU-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-doc-html-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-doc-pdf-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-kmp-default-4.2.5_02_3.0.101_0.40-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-libs-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-libs-32bit-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-tools-4.2.5_02-0.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:3, cpu:\"x86_64\", reference:\"xen-tools-domU-4.2.5_02-0.7.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-20T14:43:51", "description": "Xen has been updated to fix six security issues :\n\n - Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).\n\n - Insufficient bounding of 'REP MOVS' to MMIO emulated\n inside the hypervisor (CVE-2014-8867).\n\n - Missing privilege level checks in x86 emulation of far\n branches (CVE-2014-8595).\n\n - Guest user mode triggerable VM exits not handled by\n hypervisor (bnc#903850).\n\n - Missing privilege level checks in x86 HLT, LGDT, LIDT,\n and LMSW emulation (CVE-2014-7155).\n\n - Hypervisor heap contents leaked to guests\n (CVE-2014-4021).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 20, "published": "2015-05-20T00:00:00", "title": "SUSE SLES10 Security Update : Xen (SUSE-SU-2014:1691-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-4021", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-9030", "CVE-2014-7155"], "modified": "2015-05-20T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:xen-kmp-kdump", "p-cpe:/a:novell:suse_linux:xen-devel", "p-cpe:/a:novell:suse_linux:xen-doc-html", "p-cpe:/a:novell:suse_linux:xen-kmp-bigsmp", "p-cpe:/a:novell:suse_linux:xen-kmp-smp", "p-cpe:/a:novell:suse_linux:xen-kmp-kdumppae", "p-cpe:/a:novell:suse_linux:xen-doc-pdf", "p-cpe:/a:novell:suse_linux:xen-kmp-debug", "p-cpe:/a:novell:suse_linux:xen-kmp-default", "p-cpe:/a:novell:suse_linux:xen-tools-ioemu", "p-cpe:/a:novell:suse_linux:xen-tools-domU", "p-cpe:/a:novell:suse_linux:xen-kmp-vmipae", "p-cpe:/a:novell:suse_linux:xen-doc-ps", "cpe:/o:novell:suse_linux:10", "p-cpe:/a:novell:suse_linux:xen-libs", "p-cpe:/a:novell:suse_linux:xen", "p-cpe:/a:novell:suse_linux:xen-tools", "p-cpe:/a:novell:suse_linux:xen-kmp-vmi"], "id": "SUSE_SU-2014-1691-1.NASL", "href": "https://www.tenable.com/plugins/nessus/83651", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2014:1691-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(83651);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2014-4021\", \"CVE-2014-7155\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9030\");\n script_bugtraq_id(68070, 70057, 71149, 71151, 71207, 71331, 71332);\n\n script_name(english:\"SUSE SLES10 Security Update : Xen (SUSE-SU-2014:1691-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Xen has been updated to fix six security issues :\n\n - Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).\n\n - Insufficient bounding of 'REP MOVS' to MMIO emulated\n inside the hypervisor (CVE-2014-8867).\n\n - Missing privilege level checks in x86 emulation of far\n branches (CVE-2014-8595).\n\n - Guest user mode triggerable VM exits not handled by\n hypervisor (bnc#903850).\n\n - Missing privilege level checks in x86 HLT, LGDT, LIDT,\n and LMSW emulation (CVE-2014-7155).\n\n - Hypervisor heap contents leaked to guests\n (CVE-2014-4021).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=880751\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895799\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=903850\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=903970\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=905467\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=906439\"\n );\n # https://download.suse.com/patch/finder/?keywords=2430903f7edca75f2ff542e854abf451\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c1ba1e75\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8594/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8595/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8866/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8867/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9030/\"\n );\n # https://www.suse.com/support/update/announcement/2014/suse-su-20141691-1.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?0b43f28e\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected Xen packages\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-ps\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-bigsmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-debug\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-kdump\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-kdumppae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-smp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-vmi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-vmipae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-ioemu\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/06/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/12/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/05/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES10)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES10\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"i386|i486|i586|i686|x86_64\") audit(AUDIT_ARCH_NOT, \"i386 / i486 / i586 / i686 / x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES10\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES10 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-devel-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-doc-html-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-doc-pdf-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-doc-ps-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-libs-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-tools-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-tools-domU-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-tools-ioemu-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-libs-32bit-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"x86_64\", reference:\"xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-devel-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-doc-html-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-doc-pdf-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-doc-ps-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-libs-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-tools-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-tools-domU-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-tools-ioemu-3.2.3_17040_46-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:\"4\", cpu:\"i586\", reference:\"xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.107.24-0.9.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Xen\");\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-06T13:23:25", "description": "The remote OracleVM system is missing necessary patches to address\ncritical security updates : please see Oracle VM Security Advisory\nOVMSA-2015-0004 for details.", "edition": 26, "published": "2015-01-23T00:00:00", "title": "OracleVM 3.3 : xen (OVMSA-2015-0004)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5146", "CVE-2014-9065", "CVE-2014-8866", "CVE-2014-4021", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-9066", "CVE-2014-5149"], "modified": "2015-01-23T00:00:00", "cpe": ["cpe:/o:oracle:vm_server:3.3", "p-cpe:/a:oracle:vm:xen", "p-cpe:/a:oracle:vm:xen-tools"], "id": "ORACLEVM_OVMSA-2015-0004.NASL", "href": "https://www.tenable.com/plugins/nessus/80928", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from OracleVM\n# Security Advisory OVMSA-2015-0004.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80928);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2014-4021\", \"CVE-2014-5146\", \"CVE-2014-5149\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9065\", \"CVE-2014-9066\");\n script_bugtraq_id(68070, 69198, 69199, 71151, 71331, 71332, 71544, 71546);\n\n script_name(english:\"OracleVM 3.3 : xen (OVMSA-2015-0004)\");\n script_summary(english:\"Checks the RPM output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote OracleVM host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote OracleVM system is missing necessary patches to address\ncritical security updates : please see Oracle VM Security Advisory\nOVMSA-2015-0004 for details.\"\n );\n # https://oss.oracle.com/pipermail/oraclevm-errata/2015-January/000256.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?42e43aca\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected xen / xen-tools packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:vm:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:vm_server:3.3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/06/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"OracleVM Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleVM/release\", \"Host/OracleVM/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/OracleVM/release\");\nif (isnull(release) || \"OVS\" >!< release) audit(AUDIT_OS_NOT, \"OracleVM\");\nif (! preg(pattern:\"^OVS\" + \"3\\.3\" + \"(\\.[0-9]|$)\", string:release)) audit(AUDIT_OS_NOT, \"OracleVM 3.3\", \"OracleVM \" + release);\nif (!get_kb_item(\"Host/OracleVM/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"OracleVM\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"OVS3.3\", reference:\"xen-4.3.0-55.el6.0.16\")) flag++;\nif (rpm_check(release:\"OVS3.3\", reference:\"xen-tools-4.3.0-55.el6.0.16\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen / xen-tools\");\n}\n", "cvss": {"score": 4.9, "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-20T14:43:53", "description": "xen was updated to fix 10 security issues :\n\n - Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).\n\n - Insufficient bounding of 'REP MOVS' to MMIO emulated\n inside the hypervisor (CVE-2014-8867).\n\n - Missing privilege level checks in x86 emulation of far\n branches (CVE-2014-8595).\n\n - Missing privilege level checks in x86 HLT, LGDT, LIDT,\n and LMSW emulation (CVE-2014-7155).\n\n - Hypervisor heap contents leaked to guests\n (CVE-2014-4021).\n\n - Missing privilege level checks in x86 emulation of far\n branches (CVE-2014-8595).\n\n - Insufficient restrictions on certain MMU update\n hypercalls (CVE-2014-8594).\n\n - Intel VT-d Interrupt Remapping engines can be evaded by\n native NMI interrupts (CVE-2013-3495).\n\n - Missing privilege level checks in x86 emulation of\n software interrupts (CVE-2014-7156).\n\n - Race condition in HVMOP_track_dirty_vram\n (CVE-2014-7154).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 20, "published": "2015-05-20T00:00:00", "title": "SUSE SLES11 Security Update : xen (SUSE-SU-2014:1732-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-3495", "CVE-2014-4021", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-7156", "CVE-2014-9030", "CVE-2014-7155", "CVE-2014-7154"], "modified": "2015-05-20T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:xen-doc-html", "p-cpe:/a:novell:suse_linux:xen-kmp-trace", "cpe:/o:novell:suse_linux:11", "p-cpe:/a:novell:suse_linux:xen-doc-pdf", "p-cpe:/a:novell:suse_linux:xen-kmp-pae", "p-cpe:/a:novell:suse_linux:xen-kmp-default", "p-cpe:/a:novell:suse_linux:xen-tools-domU", "p-cpe:/a:novell:suse_linux:xen-libs", "p-cpe:/a:novell:suse_linux:xen", "p-cpe:/a:novell:suse_linux:xen-tools"], "id": "SUSE_SU-2014-1732-1.NASL", "href": "https://www.tenable.com/plugins/nessus/83659", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2014:1732-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(83659);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2013-3495\", \"CVE-2014-4021\", \"CVE-2014-7154\", \"CVE-2014-7155\", \"CVE-2014-7156\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8867\", \"CVE-2014-9030\");\n script_bugtraq_id(61854, 68070, 70055, 70057, 70062, 71149, 71151, 71207, 71331);\n\n script_name(english:\"SUSE SLES11 Security Update : xen (SUSE-SU-2014:1732-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"xen was updated to fix 10 security issues :\n\n - Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling (CVE-2014-9030).\n\n - Insufficient bounding of 'REP MOVS' to MMIO emulated\n inside the hypervisor (CVE-2014-8867).\n\n - Missing privilege level checks in x86 emulation of far\n branches (CVE-2014-8595).\n\n - Missing privilege level checks in x86 HLT, LGDT, LIDT,\n and LMSW emulation (CVE-2014-7155).\n\n - Hypervisor heap contents leaked to guests\n (CVE-2014-4021).\n\n - Missing privilege level checks in x86 emulation of far\n branches (CVE-2014-8595).\n\n - Insufficient restrictions on certain MMU update\n hypercalls (CVE-2014-8594).\n\n - Intel VT-d Interrupt Remapping engines can be evaded by\n native NMI interrupts (CVE-2013-3495).\n\n - Missing privilege level checks in x86 emulation of\n software interrupts (CVE-2014-7156).\n\n - Race condition in HVMOP_track_dirty_vram\n (CVE-2014-7154).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=826717\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=880751\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895798\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895799\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=895802\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=903967\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=903970\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=905467\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=906439\"\n );\n # https://download.suse.com/patch/finder/?keywords=39575907259e980068f0caf772c05144\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?3762a464\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2013-3495/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-4021/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7154/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7155/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-7156/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8594/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8595/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8867/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-9030/\"\n );\n # https://www.suse.com/support/update/announcement/2014/suse-su-20141732-1.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?6413f22b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 11 SP1 LTSS :\n\nzypper in -t patch slessp1-xen-10080\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-html\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-doc-pdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-default\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-pae\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-kmp-trace\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:xen-tools-domU\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/12/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/05/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"i386|i486|i586|i686|x86_64\") audit(AUDIT_ARCH_NOT, \"i386 / i486 / i586 / i686 / x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-doc-html-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-doc-pdf-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-kmp-default-4.0.3_21548_18_2.6.32.59_0.15-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-kmp-trace-4.0.3_21548_18_2.6.32.59_0.15-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-libs-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-tools-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-tools-domU-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"x86_64\", reference:\"xen-kmp-pae-4.0.3_21548_18_2.6.32.59_0.15-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-doc-html-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-doc-pdf-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-kmp-default-4.0.3_21548_18_2.6.32.59_0.15-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-kmp-trace-4.0.3_21548_18_2.6.32.59_0.15-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-libs-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-tools-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-tools-domU-4.0.3_21548_18-0.9.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"1\", cpu:\"i586\", reference:\"xen-kmp-pae-4.0.3_21548_18_2.6.32.59_0.15-0.9.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"xen\");\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}], "openvas": [{"lastseen": "2020-04-07T18:47:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-1666"], "description": "A number of security vulnerabilities have been identified in Citrix XenServer.\n These vulnerabilities could, if exploited, allow unprivileged code in an HVM guest to gain privileged execution\n within that guest and also allow privileged code within a PV or HVM guest to crash the host or other guests.", "modified": "2020-04-02T00:00:00", "published": "2014-12-18T00:00:00", "id": "OPENVAS:1361412562310105147", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310105147", "type": "openvas", "title": "Citrix XenServer Multiple Security Updates (CTX200288)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Citrix XenServer Multiple Security Updates (CTX200288)\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:citrix:xenserver\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.105147\");\n script_cve_id(\"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-1666\");\n script_tag(name:\"cvss_base\", value:\"8.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:A/AC:L/Au:N/C:C/I:C/A:C\");\n script_version(\"2020-04-02T13:53:24+0000\");\n\n script_name(\"Citrix XenServer Multiple Security Updates (CTX200288)\");\n\n script_xref(name:\"URL\", value:\"http://support.citrix.com/article/CTX200288\");\n\n script_tag(name:\"vuldetect\", value:\"Check the installed hotfixes.\");\n script_tag(name:\"solution\", value:\"Apply the hotfix referenced in the advisory.\");\n\n script_tag(name:\"summary\", value:\"A number of security vulnerabilities have been identified in Citrix XenServer.\n These vulnerabilities could, if exploited, allow unprivileged code in an HVM guest to gain privileged execution\n within that guest and also allow privileged code within a PV or HVM guest to crash the host or other guests.\");\n\n script_tag(name:\"insight\", value:\"The following vulnerabilities have been addressed:\n\n - CVE-2014-8595: Missing privilege level checks in x86 emulation of far branches\n\n - CVE-2014-8866: Excessive checking in compatibility mode hypercall argument translation\n\n - CVE-2014-8867: Insufficient bounding of `REP MOVS` to MMIO emulated inside the hypervisor\n\n - CVE-2014-1666: PHYSDEVOP_{prepare, release}_msix exposed to unprivileged guests\");\n\n script_tag(name:\"affected\", value:\"These vulnerabilities affect all currently supported versions of Citrix XenServer\n up to and including Citrix XenServer 6.2 Service Pack 1.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_tag(name:\"last_modification\", value:\"2020-04-02 13:53:24 +0000 (Thu, 02 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2014-12-18 17:37:46 +0100 (Thu, 18 Dec 2014)\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Citrix Xenserver Local Security Checks\");\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_dependencies(\"gb_xenserver_version.nasl\");\n script_mandatory_keys(\"xenserver/product_version\", \"xenserver/patches\");\n\n exit(0);\n}\n\ninclude(\"citrix_version_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"list_array_func.inc\");\n\nif( ! version = get_app_version( cpe:CPE ) )\n exit( 0 );\n\nif( ! hotfixes = get_kb_item(\"xenserver/patches\") )\n exit( 0 );\n\npatches = make_array();\n\npatches['6.2.0'] = make_list( 'XS62ESP1015' );\npatches['6.1.0'] = make_list( 'XS61E045' );\npatches['6.0.2'] = make_list( 'XS602E038' );\npatches['6.0.0'] = make_list( 'XS60E042' );\n\ncitrix_xenserver_check_report_is_vulnerable( version:version, hotfixes:hotfixes, patches:patches );\n\nexit( 99 );\n", "cvss": {"score": 8.3, "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:36:32", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-9030"], "description": "Multiple security issues have\nbeen discovered in the Xen virtualisation solution which may result in\ndenial of service, information disclosure or privilege escalation.\n\nCVE-2014-8594\nRoger Pau Monne and Jan Beulich discovered that incomplete\nrestrictions on MMU update hypercalls may result in privilege\nescalation.\n\nCVE-2014-8595\nJan Beulich discovered that missing privilege level checks in the\nx86 emulation of far branches may result in privilege escalation.\n\nCVE-2014-8866\nJan Beulich discovered that an error in compatibility mode hypercall\nargument translation may result in denial of service.\n\nCVE-2014-8867Jan Beulich discovered that an insufficient restriction in\nacceleration support for the REP MOVS\ninstruction may result in\ndenial of service.\n\nCVE-2014-9030\nAndrew Cooper discovered a page reference leak in MMU_MACHPHYS_UPDATE\nhandling, resulting in denial of service.", "modified": "2019-03-18T00:00:00", "published": "2015-01-27T00:00:00", "id": "OPENVAS:1361412562310703140", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703140", "type": "openvas", "title": "Debian Security Advisory DSA 3140-1 (xen - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3140.nasl 14278 2019-03-18 14:47:26Z cfischer $\n# Auto-generated from advisory DSA 3140-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703140\");\n script_version(\"$Revision: 14278 $\");\n script_cve_id(\"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\",\n \"CVE-2014-9030\");\n script_name(\"Debian Security Advisory DSA 3140-1 (xen - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:47:26 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-27 00:00:00 +0100 (Tue, 27 Jan 2015)\");\n script_tag(name:\"cvss_base\", value:\"7.1\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2015/dsa-3140.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"xen on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (wheezy),\nthese problems have been fixed in version 4.1.4-3+deb7u4.\n\nFor the upcoming stable distribution (jessie), these problems have been\nfixed in version 4.4.1-4.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.4.1-4.\n\nWe recommend that you upgrade your xen packages.\");\n script_tag(name:\"summary\", value:\"Multiple security issues have\nbeen discovered in the Xen virtualisation solution which may result in\ndenial of service, information disclosure or privilege escalation.\n\nCVE-2014-8594\nRoger Pau Monne and Jan Beulich discovered that incomplete\nrestrictions on MMU update hypercalls may result in privilege\nescalation.\n\nCVE-2014-8595\nJan Beulich discovered that missing privilege level checks in the\nx86 emulation of far branches may result in privilege escalation.\n\nCVE-2014-8866\nJan Beulich discovered that an error in compatibility mode hypercall\nargument translation may result in denial of service.\n\nCVE-2014-8867Jan Beulich discovered that an insufficient restriction in\nacceleration support for the REP MOVS\ninstruction may result in\ndenial of service.\n\nCVE-2014-9030\nAndrew Cooper discovered a page reference leak in MMU_MACHPHYS_UPDATE\nhandling, resulting in denial of service.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software\nversion using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libxen-4.1\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libxen-dev\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libxen-ocaml\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libxen-ocaml-dev\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libxenstore3.0\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xen-docs-4.1\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xen-hypervisor-4.1-amd64\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xen-hypervisor-4.1-i386\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xen-system-amd64\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xen-system-i386\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xen-utils-4.1\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xen-utils-common\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"xenstore-utils\", ver:\"4.1.4-3+deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2017-07-24T12:53:55", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-9030"], "description": "Multiple security issues have\nbeen discovered in the Xen virtualisation solution which may result in\ndenial of service, information disclosure or privilege escalation.\n\nCVE-2014-8594\nRoger Pau Monne and Jan Beulich discovered that incomplete\nrestrictions on MMU update hypercalls may result in privilege\nescalation.\n\nCVE-2014-8595\nJan Beulich discovered that missing privilege level checks in the\nx86 emulation of far branches may result in privilege escalation.\n\nCVE-2014-8866\nJan Beulich discovered that an error in compatibility mode hypercall\nargument translation may result in denial of service.\n\nCVE-2014-8867Jan Beulich discovered that an insufficient restriction in\nacceleration support for the REP MOVS\ninstruction may result in\ndenial of service.\n\nCVE-2014-9030\nAndrew Cooper discovered a page reference leak in MMU_MACHPHYS_UPDATE\nhandling, resulting in denial of service.", "modified": "2017-07-07T00:00:00", "published": "2015-01-27T00:00:00", "id": "OPENVAS:703140", "href": "http://plugins.openvas.org/nasl.php?oid=703140", "type": "openvas", "title": "Debian Security Advisory DSA 3140-1 (xen - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3140.nasl 6609 2017-07-07 12:05:59Z cfischer $\n# Auto-generated from advisory DSA 3140-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703140);\n script_version(\"$Revision: 6609 $\");\n script_cve_id(\"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\",\n \"CVE-2014-9030\");\n script_name(\"Debian Security Advisory DSA 3140-1 (xen - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:59 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2015-01-27 00:00:00 +0100 (Tue, 27 Jan 2015)\");\n script_tag(name:\"cvss_base\", value:\"7.1\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2015/dsa-3140.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"xen on Debian Linux\");\n script_tag(name: \"insight\", value: \"Xen is a hypervisor providing services\nthat allow multiple computer operating systems to execute on the same computer\nhardware concurrently.\");\n script_tag(name: \"solution\", value: \"For the stable distribution (wheezy),\nthese problems have been fixed in version 4.1.4-3+deb7u4.\n\nFor the upcoming stable distribution (jessie), these problems have been\nfixed in version 4.4.1-4.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.4.1-4.\n\nWe recommend that you upgrade your xen packages.\");\n script_tag(name: \"summary\", value: \"Multiple security issues have\nbeen discovered in the Xen virtualisation solution which may result in\ndenial of service, information disclosure or privilege escalation.\n\nCVE-2014-8594\nRoger Pau Monne and Jan Beulich discovered that incomplete\nrestrictions on MMU update hypercalls may result in privilege\nescalation.\n\nCVE-2014-8595\nJan Beulich discovered that missing privilege level checks in the\nx86 emulation of far branches may result in privilege escalation.\n\nCVE-2014-8866\nJan Beulich discovered that an error in compatibility mode hypercall\nargument translation may result in denial of service.\n\nCVE-2014-8867Jan Beulich discovered that an insufficient restriction in\nacceleration support for the REP MOVS\ninstruction may result in\ndenial of service.\n\nCVE-2014-9030\nAndrew Cooper discovered a page reference leak in MMU_MACHPHYS_UPDATE\nhandling, resulting in denial of service.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libxen-4.1\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libxen-dev\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libxen-ocaml\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libxen-ocaml-dev\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libxenstore3.0\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xen-docs-4.1\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xen-hypervisor-4.1-amd64\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xen-hypervisor-4.1-i386\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xen-system-amd64\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xen-system-i386\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xen-utils-4.1\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xen-utils-common\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"xenstore-utils\", ver:\"4.1.4-3+deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.1, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:36:17", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-0150", "CVE-2014-9030"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-01-05T00:00:00", "id": "OPENVAS:1361412562310868797", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868797", "type": "openvas", "title": "Fedora Update for xen FEDORA-2014-15951", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for xen FEDORA-2014-15951\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868797\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-05 14:53:20 +0100 (Mon, 05 Jan 2015)\");\n script_cve_id(\"CVE-2014-0150\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9030\",\n \"CVE-2014-8594\", \"CVE-2014-8595\");\n script_tag(name:\"cvss_base\", value:\"7.1\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_name(\"Fedora Update for xen FEDORA-2014-15951\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"xen on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2014-15951\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145761.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.4.1~9.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-01-31T18:37:56", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5146", "CVE-2013-3495", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-5149", "CVE-2014-9030"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2015-10-16T00:00:00", "id": "OPENVAS:1361412562310851016", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851016", "type": "openvas", "title": "SUSE: Security Advisory for xen (SUSE-SU-2015:0022-1)", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851016\");\n script_version(\"2020-01-31T07:58:03+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 07:58:03 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-10-16 16:51:58 +0200 (Fri, 16 Oct 2015)\");\n script_cve_id(\"CVE-2013-3495\", \"CVE-2014-5146\", \"CVE-2014-5149\", \"CVE-2014-8594\",\n \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9030\");\n script_tag(name:\"cvss_base\", value:\"7.1\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SUSE: Security Advisory for xen (SUSE-SU-2015:0022-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"xen was updated to fix nine security issues.\n\n These security issues were fixed:\n\n - Guest affectable page reference leak in MMU_MACHPHYS_UPDATE handling\n (CVE-2014-9030).\n\n - Insufficient bounding of 'REP MOVS' to MMIO emulated inside the\n hypervisor (CVE-2014-8867).\n\n - Excessive checking in compatibility mode hypercall argument translation\n (CVE-2014-8866).\n\n - Guest user mode triggerable VM exits not handled by hypervisor\n (bnc#9038500).\n\n - Missing privilege level checks in x86 emulation of far branches\n (CVE-2014-8595).\n\n - Insufficient restrictions on certain MMU update hypercalls\n (CVE-2014-8594).\n\n - Long latency virtual-mmu operations are not preemptible (CVE-2014-5146,\n CVE-2014-5149).\n\n - Intel VT-d Interrupt Remapping engines can be evaded by native NMI\n interrupts (CVE-2013-3495).\n\n These non-security issues were fixed:\n\n - Corrupted save/restore test leaves orphaned data in xenstore\n (bnc#903357).\n\n - Temporary migration name is not cleaned up after migration (bnc#903359).\n\n - Xen save/restore of HVM guests cuts off disk and networking\n (bnc#866902).\n\n - increase limit domUloader to 32MB (bnc#901317).\n\n - XEN Host crashes when assigning non-VF device (SR-IOV) to guest\n (bnc#898772).\n\n - Windows 2012 R2 fails to boot up with greater than 60 vcpus (bnc#882089).\n\n - Restrict requires on grub2-x86_64-xen to x86_64 hosts\n\n - Change default dump directory (bsc#900292).\n\n - Update xen2libvirt.py to better detect and handle file formats\n\n - libxc: check return values on mmap() and madvise() on\n xc_alloc_hypercall_buffer() (bnc#897906).\n\n - Bug `xen-tools` uninstallable grub2-x86_64-xen dependency not available\n (bnc#897614).\n\n - Adjust xentop column layout (bnc#896023).\");\n\n script_tag(name:\"affected\", value:\"xen on SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Desktop 12\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"SUSE-SU\", value:\"2015:0022-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=(SLED12\\.0SP0|SLES12\\.0SP0)\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"SLED12.0SP0\") {\n if(!isnull(res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.4.1_08~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-debugsource\", rpm:\"xen-debugsource~4.4.1_08~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default\", rpm:\"xen-kmp-default~4.4.1_08_k3.12.28_4~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default-debuginfo\", rpm:\"xen-kmp-default-debuginfo~4.4.1_08_k3.12.28_4~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-32bit\", rpm:\"xen-libs-32bit~4.4.1_08~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs\", rpm:\"xen-libs~4.4.1_08~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo-32bit\", rpm:\"xen-libs-debuginfo-32bit~4.4.1_08~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo\", rpm:\"xen-libs-debuginfo~4.4.1_08~5.2\", rls:\"SLED12.0SP0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"SLES12.0SP0\") {\n if(!isnull(res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-debugsource\", rpm:\"xen-debugsource~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-doc-html\", rpm:\"xen-doc-html~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default\", rpm:\"xen-kmp-default~4.4.1_08_k3.12.28_4~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default-debuginfo\", rpm:\"xen-kmp-default-debuginfo~4.4.1_08_k3.12.28_4~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-32bit\", rpm:\"xen-libs-32bit~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs\", rpm:\"xen-libs~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo-32bit\", rpm:\"xen-libs-debuginfo-32bit~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo\", rpm:\"xen-libs-debuginfo~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools\", rpm:\"xen-tools~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-debuginfo\", rpm:\"xen-tools-debuginfo~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-domU\", rpm:\"xen-tools-domU~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-domU-debuginfo\", rpm:\"xen-tools-domU-debuginfo~4.4.1_08~5.2\", rls:\"SLES12.0SP0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:36:10", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-9065", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2014-0150", "CVE-2014-9030"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-01-18T00:00:00", "id": "OPENVAS:1361412562310868930", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868930", "type": "openvas", "title": "Fedora Update for xen FEDORA-2015-0331", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for xen FEDORA-2015-0331\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868930\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-18 05:50:16 +0100 (Sun, 18 Jan 2015)\");\n script_cve_id(\"CVE-2015-0361\", \"CVE-2014-9065\", \"CVE-2014-8866\", \"CVE-2014-8867\",\n \"CVE-2014-9030\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-0150\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"Fedora Update for xen FEDORA-2015-0331\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"xen on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-0331\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148103.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.4.1~12.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-01-31T18:37:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5146", "CVE-2014-9065", "CVE-2013-3495", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2014-9066", "CVE-2014-5149", "CVE-2014-9030"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2015-02-07T00:00:00", "id": "OPENVAS:1361412562310850634", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310850634", "type": "openvas", "title": "openSUSE: Security Advisory for xen (openSUSE-SU-2015:0226-1)", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.850634\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-02-07 05:42:20 +0100 (Sat, 07 Feb 2015)\");\n script_cve_id(\"CVE-2013-3495\", \"CVE-2014-5146\", \"CVE-2014-5149\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9030\", \"CVE-2014-9065\", \"CVE-2014-9066\", \"CVE-2015-0361\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"openSUSE: Security Advisory for xen (openSUSE-SU-2015:0226-1)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The virtualization software XEN was updated to version 4.3.3 and also to\n fix bugs and security issues.\n\n Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use\n after free on hvm guest teardown\n\n CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation\n\n CVE-2014-9030: XSA-113: Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling\n\n CVE-2014-8867: XSA-112: xen: Insufficient bounding of 'REP MOVS' to MMIO\n emulated inside the hypervisor\n\n CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode\n hypercall argument translation\n\n CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86\n emulation of far branches\n\n CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU\n update hypercalls\n\n CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be\n evaded by native NMI interrupts\n\n CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu\n operations are not preemptible\n\n Bugs fixed:\n\n - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore\n\n - bnc#903359 - Temporary migration name is not cleaned up after migration\n\n - bnc#903850 - VUL-0: Xen: guest user mode triggerable VM exits not\n handled by hypervisor\n\n - bnc#866902 - L3: Xen save/restore of HVM guests cuts off disk and\n networking\n\n - bnc#901317 - L3: increase limit domUloader to 32MB domUloader.py\n\n - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus\n\n - bsc#900292 - xl: change default dump directory\n\n - Update to Xen 4.3.3\");\n\n script_tag(name:\"affected\", value:\"xen on openSUSE 13.1\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"openSUSE-SU\", value:\"2015:0226-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE13\\.1\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSE13.1\") {\n if(!isnull(res = isrpmvuln(pkg:\"xen-debugsource\", rpm:\"xen-debugsource~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-devel\", rpm:\"xen-devel~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default\", rpm:\"xen-kmp-default~4.3.3_04_k3.11.10_25~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default-debuginfo\", rpm:\"xen-kmp-default-debuginfo~4.3.3_04_k3.11.10_25~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-desktop\", rpm:\"xen-kmp-desktop~4.3.3_04_k3.11.10_25~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-desktop-debuginfo\", rpm:\"xen-kmp-desktop-debuginfo~4.3.3_04_k3.11.10_25~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs\", rpm:\"xen-libs~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo\", rpm:\"xen-libs-debuginfo~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-domU\", rpm:\"xen-tools-domU~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-domU-debuginfo\", rpm:\"xen-tools-domU-debuginfo~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-doc-html\", rpm:\"xen-doc-html~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-32bit\", rpm:\"xen-libs-32bit~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo-32bit\", rpm:\"xen-libs-debuginfo-32bit~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools\", rpm:\"xen-tools~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-debuginfo\", rpm:\"xen-tools-debuginfo~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-xend-tools\", rpm:\"xen-xend-tools~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-xend-tools-debuginfo\", rpm:\"xen-xend-tools-debuginfo~4.3.3_04~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-pae\", rpm:\"xen-kmp-pae~4.3.3_04_k3.11.10_25~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-pae-debuginfo\", rpm:\"xen-kmp-pae-debuginfo~4.3.3_04_k3.11.10_25~34.1\", rls:\"openSUSE13.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-01-31T18:37:33", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5146", "CVE-2014-9065", "CVE-2013-3495", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2014-9066", "CVE-2014-5149", "CVE-2014-9030"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2015-09-18T00:00:00", "id": "OPENVAS:1361412562310850677", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310850677", "type": "openvas", "title": "openSUSE: Security Advisory for xen (openSUSE-SU-2015:0256-1)", "sourceData": "# Copyright (C) 2015 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.850677\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-09-18 10:31:52 +0200 (Fri, 18 Sep 2015)\");\n script_cve_id(\"CVE-2013-3495\", \"CVE-2014-5146\", \"CVE-2014-5149\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-8866\", \"CVE-2014-8867\", \"CVE-2014-9030\", \"CVE-2014-9065\", \"CVE-2014-9066\", \"CVE-2015-0361\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for xen (openSUSE-SU-2015:0256-1)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The XEN virtualization was updated to fix bugs and security issues:\n\n Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use\n after free on hvm guest teardown\n\n CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation\n\n CVE-2014-9030: XSA-113: Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling\n\n CVE-2014-8867: XSA-112: xen: Insufficient bounding of 'REP MOVS' to MMIO\n emulated inside the hypervisor\n\n CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode\n hypercall argument translation\n\n CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86\n emulation of far branches\n\n CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU\n update hypercalls\n\n CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be\n evaded by native NMI interrupts\n\n CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu\n operations are not preemptible\n\n Bugs fixed:\n\n - Restore missing fixes from block-dmmd script\n\n - bnc#904255 - XEN boot hangs in early boot on UEFI system\n\n - Fix missing banner by restoring figlet program\n\n - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore\n\n - bnc#903359 - Temporary migration name is not cleaned up after migration\n\n - bnc#903850 - Xen: guest user mode triggerable VM exits not handled by\n hypervisor\n\n - bnc#866902 - Xen save/restore of HVM guests cuts off disk and networking\n\n - bnc#901317 - increase limit domUloader to 32MB\n\n - bnc#898772 - SLES 12 RC3 - XEN Host crashes when assigning non-VF device\n (SR-IOV) to guest\n\n - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus\n\n - bsc#900292 - xl: change default dump directory\n\n - Update xen2libvirt.py to better detect and handle file formats\n\n - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus\n\n\n - bnc#897906 - libxc: check return values on mmap() and madvise()\n on xc_alloc_hypercall_buffer()\n\n - bnc#896023 - Adjust xentop column layout\");\n\n script_tag(name:\"affected\", value:\"xen on openSUSE 13.2\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"openSUSE-SU\", value:\"2015:0256-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE13\\.2\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSE13.2\") {\n if(!isnull(res = isrpmvuln(pkg:\"xen-debugsource\", rpm:\"xen-debugsource~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-devel\", rpm:\"xen-devel~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs\", rpm:\"xen-libs~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo\", rpm:\"xen-libs-debuginfo~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-domU\", rpm:\"xen-tools-domU~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-domU-debuginfo\", rpm:\"xen-tools-domU-debuginfo~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-doc-html\", rpm:\"xen-doc-html~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default\", rpm:\"xen-kmp-default~4.4.1_08_k3.16.7_7~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-default-debuginfo\", rpm:\"xen-kmp-default-debuginfo~4.4.1_08_k3.16.7_7~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-desktop\", rpm:\"xen-kmp-desktop~4.4.1_08_k3.16.7_7~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-kmp-desktop-debuginfo\", rpm:\"xen-kmp-desktop-debuginfo~4.4.1_08_k3.16.7_7~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-32bit\", rpm:\"xen-libs-32bit~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-libs-debuginfo-32bit\", rpm:\"xen-libs-debuginfo-32bit~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools\", rpm:\"xen-tools~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"xen-tools-debuginfo\", rpm:\"xen-tools-debuginfo~4.4.1_08~9.1\", rls:\"openSUSE13.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:35:57", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-9065", "CVE-2015-2044", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2015-2045", "CVE-2014-0150", "CVE-2015-2151", "CVE-2014-9030", "CVE-2015-1563", "CVE-2015-2152"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-03-24T00:00:00", "id": "OPENVAS:1361412562310869121", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869121", "type": "openvas", "title": "Fedora Update for xen FEDORA-2015-3944", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for xen FEDORA-2015-3944\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869121\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-03-24 06:59:55 +0100 (Tue, 24 Mar 2015)\");\n script_cve_id(\"CVE-2015-2152\", \"CVE-2015-2151\", \"CVE-2015-1563\", \"CVE-2015-2044\",\n \"CVE-2015-2045\", \"CVE-2015-0361\", \"CVE-2014-9065\", \"CVE-2014-8866\",\n \"CVE-2014-8867\", \"CVE-2014-9030\", \"CVE-2014-8594\", \"CVE-2014-8595\",\n \"CVE-2014-0150\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for xen FEDORA-2015-3944\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"xen on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-3944\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.4.1~16.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:36:05", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-9065", "CVE-2015-2044", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2015-2045", "CVE-2014-0150", "CVE-2015-2752", "CVE-2015-2151", "CVE-2015-2751", "CVE-2015-2756", "CVE-2014-9030", "CVE-2015-1563", "CVE-2015-2152"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2015-04-12T00:00:00", "id": "OPENVAS:1361412562310869232", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310869232", "type": "openvas", "title": "Fedora Update for xen FEDORA-2015-5208", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for xen FEDORA-2015-5208\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.869232\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-04-12 05:55:54 +0200 (Sun, 12 Apr 2015)\");\n script_cve_id(\"CVE-2015-2752\", \"CVE-2015-2756\", \"CVE-2015-2751\", \"CVE-2015-2152\",\n \"CVE-2015-2151\", \"CVE-2015-1563\", \"CVE-2015-2044\", \"CVE-2015-2045\",\n \"CVE-2015-0361\", \"CVE-2014-9065\", \"CVE-2014-8866\", \"CVE-2014-8867\",\n \"CVE-2014-9030\", \"CVE-2014-8594\", \"CVE-2014-8595\", \"CVE-2014-0150\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for xen FEDORA-2015-5208\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'xen'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"xen on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-5208\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"xen\", rpm:\"xen~4.4.2~2.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "debian": [{"lastseen": "2020-08-12T00:56:20", "bulletinFamily": "unix", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-9030"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3140-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nJanuary 27, 2015 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : xen\nCVE ID : CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 \n CVE-2014-9030\n\nMultiple security issues have been discovered in the Xen virtualisation\nsolution which may result in denial of service, information disclosure\nor privilege escalation.\n\nCVE-2014-8594\n\n Roger Pau Monne and Jan Beulich discovered that incomplete\n restrictions on MMU update hypercalls may result in privilege\n escalation.\n\nCVE-2014-8595\n\n Jan Beulich discovered that missing privilege level checks in the\n x86 emulation of far branches may result in privilege escalation.\n\nCVE-2014-8866\n\n Jan Beulich discovered that an error in compatibility mode hypercall\n argument translation may result in denial of service.\n\nCVE-2014-8867\n\n Jan Beulich discovered that an insufficient restriction in\n acceleration support for the "REP MOVS" instruction may result in\n denial of service.\n\nCVE-2014-9030\n\n Andrew Cooper discovered a page reference leak in MMU_MACHPHYS_UPDATE\n handling, resulting in denial of service.\n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 4.1.4-3+deb7u4.\n\nFor the upcoming stable distribution (jessie), these problems have been\nfixed in version 4.4.1-4.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.4.1-4.\n\nWe recommend that you upgrade your xen packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 11, "modified": "2015-01-27T10:54:05", "published": "2015-01-27T10:54:05", "id": "DEBIAN:DSA-3140-1:0F141", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2015/msg00023.html", "title": "[SECURITY] [DSA 3140-1] xen security update", "type": "debian", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:57", "bulletinFamily": "software", "cvelist": ["CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-9030"], "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-3140-1 security@debian.org\r\nhttp://www.debian.org/security/ Moritz Muehlenhoff\r\nJanuary 27, 2015 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : xen\r\nCVE ID : CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 \r\n CVE-2014-9030\r\n\r\nMultiple security issues have been discovered in the Xen virtualisation\r\nsolution which may result in denial of service, information disclosure\r\nor privilege escalation.\r\n\r\nCVE-2014-8594\r\n\r\n Roger Pau Monne and Jan Beulich discovered that incomplete\r\n restrictions on MMU update hypercalls may result in privilege\r\n escalation.\r\n\r\nCVE-2014-8595\r\n\r\n Jan Beulich discovered that missing privilege level checks in the\r\n x86 emulation of far branches may result in privilege escalation.\r\n\r\nCVE-2014-8866\r\n\r\n Jan Beulich discovered that an error in compatibility mode hypercall\r\n argument translation may result in denial of service.\r\n\r\nCVE-2014-8867\r\n\r\n Jan Beulich discovered that an insufficient restriction in\r\n acceleration support for the "REP MOVS" instruction may result in\r\n denial of service.\r\n\r\nCVE-2014-9030\r\n\r\n Andrew Cooper discovered a page reference leak in MMU_MACHPHYS_UPDATE\r\n handling, resulting in denial of service.\r\n\r\nFor the stable distribution (wheezy), these problems have been fixed in\r\nversion 4.1.4-3+deb7u4.\r\n\r\nFor the upcoming stable distribution (jessie), these problems have been\r\nfixed in version 4.4.1-4.\r\n\r\nFor the unstable distribution (sid), these problems have been fixed in\r\nversion 4.4.1-4.\r\n\r\nWe recommend that you upgrade your xen packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: https://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\n\r\niQIcBAEBAgAGBQJUx233AAoJEBDCk7bDfE427SwP/0vk4BEClNotQKKEEJduVMP2\r\nzb8b++/f4ZocQgezJ9/oew8UGgd9Klq6XcIh5BVaQi6PD70sw4uWX03820PCs88X\r\nywRCrTHSXPfPlwOG6dY8nZ1oOUItP64N03j+nugI27GNPgmJpu7xgewmY+c8vZpF\r\nr5sEjhINwgDmHMCgb8bCFKQ/7UDUcE2MZJVF++oWuKusvCFo57cG/pakRwF9XFsw\r\nAw24obp7vySzOs5mThid3asOHcNqUYZml1YTI6E3nxL+bL9K11KFZzl98a75Q4YI\r\nHJJuqJk3H5CO+GCSq2Dl6NzHBWA7hCFepaKilhj/Ao6vnAoqbkFjklwczofXM6fq\r\nwQ1586wFp6ZTFtawn66DKoeT3CQp+OhOce5N4X3num6Ev32yaK8Rox7CF9xena6Q\r\nubEEW2pKKblwFJRVm9wyBo1RQvPUyMUsvbq+DNX2GBJ1+wOzIMqm0K9G7+nFlGI8\r\nZ7u3RIgLTolzgFN0NR6B4A03/0kOYKNlrFuJB8wXerkwFsK/X4wX/f2dRJRleiNX\r\nJzDvWYCfcjWTrRjcvGdotNELdDoz+eePFuRzp7Os4SdJE2dxdWBsmvqU/NXc8pBL\r\nd1FtjPArM8IndL0Mf6+oPz3uAAFPjbaeTRQk/uhX7HPVN9gLDqyLWGuCsaf+seMu\r\n9IwVAOzHz+HymOHT02af\r\n=5heI\r\n-----END PGP SIGNATURE-----\r\n\r\n", "edition": 1, "modified": "2015-02-02T00:00:00", "published": "2015-02-02T00:00:00", "id": "SECURITYVULNS:DOC:31685", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31685", "title": "[SECURITY] [DSA 3140-1] xen security update", "type": "securityvulns", "cvss": {"score": 7.1, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "fedora": [{"lastseen": "2020-12-21T08:17:52", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2014-12-12T04:01:42", "published": "2014-12-12T04:01:42", "id": "FEDORA:DEF6E60C424A", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.1-9.fc21", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-01-17T05:35:38", "published": "2015-01-17T05:35:38", "id": "FEDORA:1F082605DFF5", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.1-12.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-03-23T07:10:24", "published": "2015-03-23T07:10:24", "id": "FEDORA:DD565608792C", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.1-16.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152", "CVE-2015-2751", "CVE-2015-2752", "CVE-2015-2756"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-04-11T09:04:58", "published": "2015-04-11T09:04:58", "id": "FEDORA:563A36087B2E", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.2-2.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152", "CVE-2015-2751", "CVE-2015-2752", "CVE-2015-2756", "CVE-2015-3340"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-05-02T18:04:27", "published": "2015-05-02T18:04:27", "id": "FEDORA:5F8A86077990", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.2-3.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152", "CVE-2015-2751", "CVE-2015-2752", "CVE-2015-2756", "CVE-2015-3340", "CVE-2015-3456"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-05-26T03:21:20", "published": "2015-05-26T03:21:20", "id": "FEDORA:299546076F66", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.2-4.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152", "CVE-2015-2751", "CVE-2015-2752", "CVE-2015-2756", "CVE-2015-3340", "CVE-2015-3456", "CVE-2015-4103", "CVE-2015-4104", "CVE-2015-4105", "CVE-2015-4106"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-06-14T17:28:36", "published": "2015-06-14T17:28:36", "id": "FEDORA:787C96087980", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.2-5.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152", "CVE-2015-2751", "CVE-2015-2752", "CVE-2015-2756", "CVE-2015-3209", "CVE-2015-3340", "CVE-2015-3456", "CVE-2015-4103", "CVE-2015-4104", "CVE-2015-4105", "CVE-2015-4106", "CVE-2015-4163", "CVE-2015-4164"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-06-24T16:02:30", "published": "2015-06-24T16:02:30", "id": "FEDORA:684B76087C09", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.2-6.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152", "CVE-2015-2751", "CVE-2015-2752", "CVE-2015-2756", "CVE-2015-3209", "CVE-2015-3259", "CVE-2015-3340", "CVE-2015-3456", "CVE-2015-4103", "CVE-2015-4104", "CVE-2015-4105", "CVE-2015-4106", "CVE-2015-4163", "CVE-2015-4164"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-07-19T01:59:50", "published": "2015-07-19T01:59:50", "id": "FEDORA:03EEF60499DD", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.2-7.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:53", "bulletinFamily": "unix", "cvelist": ["CVE-2014-0150", "CVE-2014-8594", "CVE-2014-8595", "CVE-2014-8866", "CVE-2014-8867", "CVE-2014-9030", "CVE-2014-9065", "CVE-2015-0361", "CVE-2015-1563", "CVE-2015-2044", "CVE-2015-2045", "CVE-2015-2151", "CVE-2015-2152", "CVE-2015-2751", "CVE-2015-2752", "CVE-2015-2756", "CVE-2015-3209", "CVE-2015-3259", "CVE-2015-3340", "CVE-2015-3456", "CVE-2015-4103", "CVE-2015-4104", "CVE-2015-4105", "CVE-2015-4106", "CVE-2015-4163", "CVE-2015-4164", "CVE-2015-5154"], "description": "This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor ", "modified": "2015-08-12T07:01:13", "published": "2015-08-12T07:01:13", "id": "FEDORA:D3AC8608A1F3", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: xen-4.4.2-9.fc21", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "suse": [{"lastseen": "2016-09-04T12:09:51", "bulletinFamily": "unix", "cvelist": ["CVE-2014-5146", "CVE-2013-3495", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2014-8594", "CVE-2014-5149", "CVE-2014-9030"], "description": "xen was updated to fix nine security issues.\n\n These security issues were fixed:\n - Guest affectable page reference leak in MMU_MACHPHYS_UPDATE handling\n (CVE-2014-9030).\n - Insufficient bounding of "REP MOVS" to MMIO emulated inside the\n hypervisor (CVE-2014-8867).\n - Excessive checking in compatibility mode hypercall argument translation\n (CVE-2014-8866).\n - Guest user mode triggerable VM exits not handled by hypervisor\n (bnc#9038500).\n - Missing privilege level checks in x86 emulation of far branches\n (CVE-2014-8595).\n - Insufficient restrictions on certain MMU update hypercalls\n (CVE-2014-8594).\n - Long latency virtual-mmu operations are not preemptible (CVE-2014-5146,\n CVE-2014-5149).\n - Intel VT-d Interrupt Remapping engines can be evaded by native NMI\n interrupts (CVE-2013-3495).\n\n These non-security issues were fixed:\n - Corrupted save/restore test leaves orphaned data in xenstore\n (bnc#903357).\n - Temporary migration name is not cleaned up after migration (bnc#903359).\n - Xen save/restore of HVM guests cuts off disk and networking\n (bnc#866902).\n - increase limit domUloader to 32MB (bnc#901317).\n - XEN Host crashes when assigning non-VF device (SR-IOV) to guest\n (bnc#898772).\n - Windows 2012 R2 fails to boot up with greater than 60 vcpus (bnc#882089).\n - Restrict requires on grub2-x86_64-xen to x86_64 hosts\n - Change default dump directory (bsc#900292).\n - Update xen2libvirt.py to better detect and handle file formats\n - libxc: check return values on mmap() and madvise() on\n xc_alloc_hypercall_buffer() (bnc#897906).\n - Bug `xen-tools` uninstallable; grub2-x86_64-xen dependency not available\n (bnc#897614).\n - Adjust xentop column layout (bnc#896023).\n\n", "edition": 1, "modified": "2015-01-09T12:04:44", "published": "2015-01-09T12:04:44", "id": "SUSE-SU-2015:0022-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00003.html", "type": "suse", "title": "Security update for xen (important)", "cvss": {"score": 7.1, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:45:45", "bulletinFamily": "unix", "cvelist": ["CVE-2014-5146", "CVE-2014-9065", "CVE-2013-3495", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2014-9066", "CVE-2014-5149", "CVE-2014-9030"], "description": "The virtualization software XEN was updated to version 4.3.3 and also to\n fix bugs and security issues.\n\n Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use\n after free on hvm guest teardown\n\n CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation\n\n CVE-2014-9030: XSA-113: Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling\n\n CVE-2014-8867: XSA-112: xen: Insufficient bounding of "REP MOVS" to MMIO\n emulated inside the hypervisor\n\n CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode\n hypercall argument translation\n\n CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86\n emulation of far branches\n\n CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU\n update hypercalls\n\n CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be\n evaded by native NMI interrupts\n\n CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu\n operations are not preemptible\n\n Bugs fixed:\n - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore\n\n - bnc#903359 - Temporary migration name is not cleaned up after migration\n\n - bnc#903850 - VUL-0: Xen: guest user mode triggerable VM exits not\n handled by hypervisor\n\n - bnc#866902 - L3: Xen save/restore of HVM guests cuts off disk and\n networking\n\n - bnc#901317 - L3: increase limit domUloader to 32MB domUloader.py\n\n - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus\n\n - bsc#900292 - xl: change default dump directory\n\n - Update to Xen 4.3.3\n\n", "edition": 1, "modified": "2015-02-06T11:05:09", "published": "2015-02-06T11:05:09", "id": "OPENSUSE-SU-2015:0226-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html", "title": "Security update for xen (important)", "type": "suse", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:09:51", "bulletinFamily": "unix", "cvelist": ["CVE-2014-5146", "CVE-2014-9065", "CVE-2013-3495", "CVE-2014-8866", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2014-9066", "CVE-2014-5149", "CVE-2014-9030"], "description": "The XEN virtualization was updated to fix bugs and security issues:\n\n Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use\n after free on hvm guest teardown\n\n CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation\n\n CVE-2014-9030: XSA-113: Guest effectable page reference leak in\n MMU_MACHPHYS_UPDATE handling\n\n CVE-2014-8867: XSA-112: xen: Insufficient bounding of "REP MOVS" to MMIO\n emulated inside the hypervisor\n\n CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode\n hypercall argument translation\n\n CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86\n emulation of far branches\n\n CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU\n update hypercalls\n\n CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be\n evaded by native NMI interrupts\n\n CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu\n operations are not preemptible\n\n Bugs fixed:\n - Restore missing fixes from block-dmmd script\n\n - bnc#904255 - XEN boot hangs in early boot on UEFI system\n\n - Fix missing banner by restoring figlet program\n\n - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore\n\n - bnc#903359 - Temporary migration name is not cleaned up after migration\n\n - bnc#903850 - Xen: guest user mode triggerable VM exits not handled by\n hypervisor\n\n - bnc#866902 - Xen save/restore of HVM guests cuts off disk and networking\n\n - bnc#901317 - increase limit domUloader to 32MB\n\n - bnc#898772 - SLES 12 RC3 - XEN Host crashes when assigning non-VF device\n (SR-IOV) to guest\n\n - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus\n\n - bsc#900292 - xl: change default dump directory\n\n - Update xen2libvirt.py to better detect and handle file formats\n\n - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus\n\n\n - bnc#897906 - libxc: check return values on mmap() and madvise()\n on xc_alloc_hypercall_buffer()\n\n - bnc#896023 - Adjust xentop column layout\n\n", "edition": 1, "modified": "2015-02-11T15:05:20", "published": "2015-02-11T15:05:20", "id": "OPENSUSE-SU-2015:0256-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html", "type": "suse", "title": "Security update for xen (important)", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:07", "bulletinFamily": "unix", "cvelist": ["CVE-2014-5146", "CVE-2014-9065", "CVE-2013-3495", "CVE-2015-2044", "CVE-2014-8866", "CVE-2014-3967", "CVE-2014-8595", "CVE-2014-8867", "CVE-2015-0361", "CVE-2014-8594", "CVE-2015-2045", "CVE-2015-2752", "CVE-2014-3968", "CVE-2015-2751", "CVE-2014-9066", "CVE-2015-2756", "CVE-2014-5149", "CVE-2014-9030", "CVE-2015-2152", "CVE-2013-2212"], "description": "### Background\n\nXen is a bare-metal hypervisor.\n\n### Description\n\nMultiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA local attacker could possibly cause a Denial of Service condition or obtain sensitive information. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Xen 4.4 users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-emulation/xen-4.4.2-r1\"\n \n\nAll Xen 4.2 users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-emulation/xen-4.2.5-r8\"", "edition": 1, "modified": "2015-04-11T00:00:00", "published": "2015-04-11T00:00:00", "id": "GLSA-201504-04", "href": "https://security.gentoo.org/glsa/201504-04", "type": "gentoo", "title": "Xen: Multiple vulnerabilities", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}]}
