Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2015.0596 Citrix XenServer Multiple Security Updates 12 March 2015 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Citrix XenServer Publisher: Citrix Operating System: Citrix XenServer Impact/Access: Increased Privileges -- Existing Account Denial of Service -- Existing Account Access Confidential Data -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2015-2151 CVE-2015-2045 CVE-2015-2044 Reference: ESB-2015.0569 ESB-2015.0538 Original Bulletin: https://support.citrix.com/article/CTX200484 - --------------------------BEGIN INCLUDED TEXT-------------------- Citrix XenServer Multiple Security Updates CTX200484 Created onMar 02, 2015 Updated onMar 11, 2015 Security Bulletin Description of Problem A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities could, if exploited, allow unprivileged code in a guest to corrupt the host or other guests and also allow privileged code within a guest to read data potentially belonging to the hypervisor or other guests. These vulnerabilities affect all currently supported versions of Citrix XenServer up to and including Citrix XenServer 6.5. The following vulnerabilities have been addressed: CVE-2015-2044 (Medium): Information leak via internal x86 system device emulation CVE-2015-2045 (Medium): Information leak through version information hypercall CVE-2015-2151 (Medium): Hypervisor memory corruption due to x86 emulator flaw What Customers Should Do Hotfixes have been released to address these issues. Citrix recommends that affected customers install the relevant hotfixes, which can be downloaded from the following locations: Citrix XenServer 6.5: CTX142147 https://support.citrix.com/article/CTX142147 Citrix XenServer 6.2 Service Pack 1: CTX142146 https://support.citrix.com/article/CTX142146 Citrix XenServer 6.1: CTX142145 https://support.citrix.com/article/CTX142145 Citrix XenServer 6.0.2: CTX142143 https://support.citrix.com/article/CTX142143 Customers using Citrix XenServer 6.0.2 in the Common Criteria evaluated configuration should apply the following hotfixes: CTX142144 https://support.citrix.com/article/CTX142144 Citrix XenServer 6.0.0: CTX142142 https://support.citrix.com/article/CTX142142 What Citrix Is Doing Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at http://support.citrix.com/. Obtaining Support on This Issue If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at http://www.citrix.com/site/ss/supportContacts.asp. Reporting Security Vulnerabilities Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For guidance on how to report security-related issues to Citrix, please see the following document: CTX081743 Reporting Security Issues to Citrix Changelog Date Change March 11th 2015 Initial bulletin publishing - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVQEIkRLndAQH1ShLAQLwmw//Yp6FXvPTnZyA5DbbtXnPW0yPEwCZOt04 TvGLvYcW6k9j16aBor+ipf5u1KQy4IJIGl1jedwhJ56YsqG+crHrplF3RSGYdJiH tgAPLxo8LmKRbmo9gM0S3f27Fn5fCFXYoY4iCw8UHm3SP6zNBnXB+A2gGFX5rMkb AO2TgccFoozfbG1wPMDv1dOlOjB/ylJTyve7lU3AbJvWiKDbOh50CJuZekP9Gmym 65dtbPQKrtYhvwLnkqrfoN82MixBj7UI/08uhNlEjxzjXeLz0hajM0GBWCO3qxCx 38vkQm1AUR4rRTcdgzd3WPiDs/2ebfOnVfFnT3udQ/gqA8gPbhH6x7uddmmq8EHu J+lHTzV1Jm7647Ha8nm78MOazDdWmnEedKp4OsxebyoztZkddTMxI1ywcSRov770 vloXTob6q5Bu9v3HCkhRCnnUgVUqBZfnIOoIHBb9IvVSkObcg+d4EW4Fr/p4STwr EsFptBB2Il7nYf/OIs6DwqoMTpPRQoZ2XF7XXh94cFqx8kGz+k6FOe7AKDfpnLuV BsSewVOYO9BlbIhecAXZkelaU5qOZISNUvGoXnZF3BfBdI6PpYFWTX6xQuVKh8Lm onH0K4hMnzvOs0Iy5ZweN7o4hzMwsgQVjKG9jGAhxB/ybjwECRItPNzdm1pR+lZu sPMfi6r6D1w= =4r23 -----END PGP SIGNATURE-----