Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

                Citrix XenServer Multiple Security Updates
                               12 March 2015


        AusCERT Security Bulletin Summary

Product:           Citrix XenServer
Publisher:         Citrix
Operating System:  Citrix XenServer
Impact/Access:     Increased Privileges     -- Existing Account
                   Denial of Service        -- Existing Account
                   Access Confidential Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-2151 CVE-2015-2045 CVE-2015-2044

Reference:         ESB-2015.0569

Original Bulletin: 

- --------------------------BEGIN INCLUDED TEXT--------------------

Citrix XenServer Multiple Security Updates

CTX200484 Created onMar 02, 2015 Updated onMar 11, 2015

Security Bulletin

Description of Problem

A number of security vulnerabilities have been identified in Citrix XenServer.
These vulnerabilities could, if exploited, allow unprivileged code in a guest
to corrupt the host or other guests and also allow privileged code within a 
guest to read data potentially belonging to the hypervisor or other guests.

These vulnerabilities affect all currently supported versions of Citrix 
XenServer up to and including Citrix XenServer 6.5.

The following vulnerabilities have been addressed:

   CVE-2015-2044 (Medium): Information leak via internal x86 system device 

   CVE-2015-2045 (Medium): Information leak through version information hypercall

   CVE-2015-2151 (Medium): Hypervisor memory corruption due to x86 emulator flaw

What Customers Should Do

Hotfixes have been released to address these issues. Citrix recommends that 
affected customers install the relevant hotfixes, which can be downloaded from
the following locations:

Citrix XenServer 6.5: CTX142147 https://support.citrix.com/article/CTX142147

Citrix XenServer 6.2 Service Pack 1: CTX142146 

Citrix XenServer 6.1: CTX142145 https://support.citrix.com/article/CTX142145

Citrix XenServer 6.0.2: CTX142143 https://support.citrix.com/article/CTX142143

Customers using Citrix XenServer 6.0.2 in the Common Criteria evaluated 
configuration should apply the following hotfixes: CTX142144 

Citrix XenServer 6.0.0: CTX142142 https://support.citrix.com/article/CTX142142

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential 
security issue. This article is also available from the Citrix Knowledge 
Center at http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix 
Technical Support. Contact details for Citrix Technical Support are available
at http://www.citrix.com/site/ss/supportContacts.asp.

Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and considers any
and all potential vulnerabilities seriously. For guidance on how to report 
security-related issues to Citrix, please see the following document: 
CTX081743 Reporting Security Issues to Citrix


	Date 				Change

    	 March 11th 2015 		Initial bulletin publishing

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967