The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86: properly set up fbld emulation operand address This     is XSA-66. (CVE-2013-4361)

  - x86: properly handle hvm_copy_from_guest_[phys,virt]     errors Ignoring them generally implies using     uninitialized data and, in all cases dealt with here,     potentially leaking hypervisor stack contents to guests.
    This is XSA-63. (CVE-2013-4355)

Xen was updated to 4.1.6 c/s 23588 to fix various bugs and security issues.

Following changes are listed :

  - Comment out the -include directive in Config.mk as the     build service build seems to error out not finding     '.config' xen-config.diff

  - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored     mishandles oversized message replies

  - Improvements to block-dmmd script bnc#828623

  - bnc#840196 - MTU size on Dom0 gets reset when booting     DomU with e1000 device

  - bnc#840592 - CVE-2013-4355: XSA-63: xen: Information     leaks through I/O instruction emulation

  - bnc#841766 - CVE-2013-4361: XSA-66: xen: Information     leak through fbld instruction emulation

  - bnc#842511 - CVE-2013-4368: XSA-67: xen: Information     leak through outs instruction emulation

  - xen/27397-ACPI-fix-acpi_os_map_memory.patch: address     regression

  - bnc#839596 - CVE-2013-1442: XSA-62: xen: Information     leak on AVX and/or LWP capable CPUs

  - bnc#833251 - In HP&rsquo;s UEFI x86_64 platform and with     xen environment, in booting stage ,xen hypervisor will     panic.

  - bnc#833796 - Xen: migration broken from xsave-capable to     xsave-incapable host

  - bnc#834751 - In xen, &ldquo;shutdown &ndash;y 0     &ndash;h&rdquo; cannot power off system

  - bnc#833251 - In HP&rsquo;s UEFI x86_64 platform and with     xen environment, in booting stage ,xen hypervisor will     panic.

  - bnc#839600 - In HP&rsquo;s UEFI x86_64 platform and     sles11sp3 with xen environment, xen hypervisor will     panic on multiple blades nPar.

Multiple security issues have been discovered in the Xen virtualisation solution which may result in information leaks or denial of service.

Three security fixes CVE-2013-4355 CVE-2013-4356 CVE-2013-4361, Set 'Domain-0' label in xenstored.service systemd file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security fixes CVE-2013-4355 CVE-2013-4361, Set 'Domain-0' label in xenstored.service systemd file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues.

  - CVE-2013-4416: XSA-72: Fixed ocaml xenstored that     mishandled oversized message replies

  - CVE-2013-4355: XSA-63: Fixed information leaks through     I/O instruction emulation

  - CVE-2013-4361: XSA-66: Fixed information leak through     fbld instruction emulation

  - CVE-2013-4368: XSA-67: Fixed information leak through     outs instruction emulation

  - CVE-2013-4369: XSA-68: Fixed possible null dereference     when parsing vif ratelimiting info

  - CVE-2013-4370: XSA-69: Fixed misplaced free in ocaml     xc_vcpu_getaffinity stub

  - CVE-2013-4371: XSA-70: Fixed use-after-free in     libxl_list_cpupool under memory pressure

  - CVE-2013-4375: XSA-71: xen: qemu disk backend (qdisk)     resource leak

  - CVE-2013-1442: XSA-62: Fixed information leak on AVX     and/or LWP capable CPUs

  - CVE-2013-1432: XSA-58: Page reference counting error due     to XSA-45/CVE-2013-1918 fixes.

Various bugs have also been fixed :

  - Boot failure with xen kernel in UEFI mode with error 'No     memory for trampoline' (bnc#833483)

  - Improvements to block-dmmd script (bnc#828623)

  - MTU size on Dom0 gets reset when booting DomU with e1000     device (bnc#840196)

  - In HP's UEFI x86_64 platform and with xen environment,     in booting stage, xen hypervisor will panic.
    (bnc#833251)

  - Xen: migration broken from xsave-capable to     xsave-incapable host (bnc#833796)

  - In xen, 'shutdown -y 0 -h' cannot power off system     (bnc#834751)

  - In HP's UEFI x86_64 platform with xen environment, xen     hypervisor will panic on multiple blades nPar.
    (bnc#839600)

  - vcpus not started after upgrading Dom0 from SLES 11 SP2     to SP3 (bnc#835896)

  - SLES 11 SP3 Xen security patch does not automatically     update UEFI boot binary (bnc#836239)

  - Failed to setup devices for vm instance when start     multiple vms simultaneously (bnc#824676)

  - SLES 9 SP4 guest fails to start after upgrading to SLES     11 SP3 (bnc#817799)

  - Various upstream fixes have been included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
79517	OracleVM 3.2 : xen (OVMSA-2013-0070)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	low
75189	openSUSE Security Update : xen (openSUSE-SU-2013:1636-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
77240	Debian DSA-3006-1 : xen - security update	Nessus	Debian Local Security Checks	2014/8/19	2021/1/11	high
70421	Fedora 20 : xen-4.3.0-7.fc20 (2013-18300)	Nessus	Fedora Local Security Checks	2013/10/15	2021/1/11	medium
70427	Fedora 18 : xen-4.2.3-3.fc18 (2013-18373)	Nessus	Fedora Local Security Checks	2013/10/15	2021/1/11	low
83602	SUSE SLED11 / SLES11 Security Update : Xen (SUSE-SU-2013:1774-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high

検出

プラグインの検索

low

medium

high

medium

low

high