I'n Blog 之萬象真藏

Secunia Advisory:	SA26986
Release Date:	2007-09-27
Critical:	Less critical
Impact:	Security Bypass Privilege escalation
Where:	Local system
Solution Status:	Unpatched
Software:	Xen 3.x
CVE reference:	CVE-2007-4993 (Secunia mirror)

:
Joris van Rantwijk has reported a vulnerability in Xen, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to an input validation error in tools/pygrub/src/GrubConf.py. This can be exploited by "root" users of a guest domain to execute arbitrary commands in domain 0 via specially crafted entries in grub.conf when the guest system is booted.

The vulnerability is reported in Xen 3.0.3. Other versions may also be affected.

Solution:
Grant only trusted users "root" privileges to guest domains.
Provided and/or discovered by:
Joris van Rantwijk

Original Advisory:
http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1068

資料來源 Secunia