Test ID:	1.3.6.1.4.1.25623.1.0.702666
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2666-1)
Summary:	The remote host is missing an update for the Debian 'xen' package(s) announced via the DSA-2666-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'xen' package(s) announced via the DSA-2666-1 advisory. Vulnerability Insight: Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1918 (XSA 45) several long latency operations are not preemptible. Some page table manipulation operations for PV guests were not made preemptible, allowing a malicious or buggy PV guest kernel to mount a denial of service attack affecting the whole system. CVE-2013-1952 (XSA 49) VT-d interrupt remapping source validation flaw for bridges. Due to missing source validation on interrupt remapping table entries for MSI interrupts set up by bridge devices, a malicious domain with access to such a device can mount a denial of service attack affecting the whole system. CVE-2013-1964 (XSA 50) grant table hypercall acquire/release imbalance. When releasing a particular, non-transitive grant after doing a grant copy operation, Xen incorrectly releases an unrelated grant reference, leading possibly to a crash of the host system. Furthermore information leakage or privilege escalation cannot be ruled out. For the oldstable distribution (squeeze), these problems have been fixed in version 4.0.1-5.11. For the stable distribution (wheezy), these problems have been fixed in version 4.1.4-3+deb7u1. For the testing distribution (jessie), these problems have been fixed in version 4.1.4-4. For the unstable distribution (sid), these problems have been fixed in version 4.1.4-4. Note that for the stable (wheezy), testing and unstable distribution, CVE-2013-1964 (XSA 50) was already fixed in version 4.1.4-3. We recommend that you upgrade your xen packages. Affected Software/OS: 'xen' package(s) on Debian 6, Debian 7. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1918 53187 http://secunia.com/advisories/53187 55082 http://secunia.com/advisories/55082 59615 http://www.securityfocus.com/bid/59615 DSA-2666 http://www.debian.org/security/2013/dsa-2666 FEDORA-2013-7432 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105533.html GLSA-201309-24 http://security.gentoo.org/glsa/glsa-201309-24.xml SUSE-SU-2014:0446 http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html [oss-security] 20130502 Xen Security Advisory 45 (CVE-2013-1918) - Several long latency operations are not preemptible http://www.openwall.com/lists/oss-security/2013/05/02/8 Common Vulnerability Exposure (CVE) ID: CVE-2013-1952 53312 http://secunia.com/advisories/53312 59617 http://www.securityfocus.com/bid/59617 92984 http://osvdb.org/92984 [oss-security] 20130502 Xen Security Advisory 49 (CVE-2013-1952) - VT-d interrupt remapping source validation flaw for bridges http://www.openwall.com/lists/oss-security/2013/05/02/9 xen-cve20131952-dos(83968) https://exchange.xforce.ibmcloud.com/vulnerabilities/83968 Common Vulnerability Exposure (CVE) ID: CVE-2013-1964 1028459 http://www.securitytracker.com/id/1028459 59293 http://www.securityfocus.com/bid/59293 FEDORA-2013-6723 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html [oss-security] 20130418 Xen Security Advisory 50 (CVE-2013-1964) - grant table hypercall acquire/release imbalance http://www.openwall.com/lists/oss-security/2013/04/18/9
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.