-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.0596
                Citrix XenServer Multiple Security Updates
                               12 March 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Citrix XenServer
Publisher:         Citrix
Operating System:  Citrix XenServer
Impact/Access:     Increased Privileges     -- Existing Account
                   Denial of Service        -- Existing Account
                   Access Confidential Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-2151 CVE-2015-2045 CVE-2015-2044

Reference:         ESB-2015.0569
                   ESB-2015.0538

Original Bulletin: 
   https://support.citrix.com/article/CTX200484

- --------------------------BEGIN INCLUDED TEXT--------------------

Citrix XenServer Multiple Security Updates

CTX200484 Created onMar 02, 2015 Updated onMar 11, 2015

Security Bulletin

Description of Problem

A number of security vulnerabilities have been identified in Citrix XenServer.
These vulnerabilities could, if exploited, allow unprivileged code in a guest
to corrupt the host or other guests and also allow privileged code within a 
guest to read data potentially belonging to the hypervisor or other guests.

These vulnerabilities affect all currently supported versions of Citrix 
XenServer up to and including Citrix XenServer 6.5.

The following vulnerabilities have been addressed:

   CVE-2015-2044 (Medium): Information leak via internal x86 system device 
   emulation

   CVE-2015-2045 (Medium): Information leak through version information hypercall

   CVE-2015-2151 (Medium): Hypervisor memory corruption due to x86 emulator flaw

What Customers Should Do

Hotfixes have been released to address these issues. Citrix recommends that 
affected customers install the relevant hotfixes, which can be downloaded from
the following locations:

Citrix XenServer 6.5: CTX142147 https://support.citrix.com/article/CTX142147

Citrix XenServer 6.2 Service Pack 1: CTX142146 
https://support.citrix.com/article/CTX142146

Citrix XenServer 6.1: CTX142145 https://support.citrix.com/article/CTX142145

Citrix XenServer 6.0.2: CTX142143 https://support.citrix.com/article/CTX142143

Customers using Citrix XenServer 6.0.2 in the Common Criteria evaluated 
configuration should apply the following hotfixes: CTX142144 
https://support.citrix.com/article/CTX142144

Citrix XenServer 6.0.0: CTX142142 https://support.citrix.com/article/CTX142142

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential 
security issue. This article is also available from the Citrix Knowledge 
Center at http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix 
Technical Support. Contact details for Citrix Technical Support are available
at http://www.citrix.com/site/ss/supportContacts.asp.

Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and considers any
and all potential vulnerabilities seriously. For guidance on how to report 
security-related issues to Citrix, please see the following document: 
CTX081743 Reporting Security Issues to Citrix

Changelog

	Date 				Change

    	 March 11th 2015 		Initial bulletin publishing

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVQEIkRLndAQH1ShLAQLwmw//Yp6FXvPTnZyA5DbbtXnPW0yPEwCZOt04
TvGLvYcW6k9j16aBor+ipf5u1KQy4IJIGl1jedwhJ56YsqG+crHrplF3RSGYdJiH
tgAPLxo8LmKRbmo9gM0S3f27Fn5fCFXYoY4iCw8UHm3SP6zNBnXB+A2gGFX5rMkb
AO2TgccFoozfbG1wPMDv1dOlOjB/ylJTyve7lU3AbJvWiKDbOh50CJuZekP9Gmym
65dtbPQKrtYhvwLnkqrfoN82MixBj7UI/08uhNlEjxzjXeLz0hajM0GBWCO3qxCx
38vkQm1AUR4rRTcdgzd3WPiDs/2ebfOnVfFnT3udQ/gqA8gPbhH6x7uddmmq8EHu
J+lHTzV1Jm7647Ha8nm78MOazDdWmnEedKp4OsxebyoztZkddTMxI1ywcSRov770
vloXTob6q5Bu9v3HCkhRCnnUgVUqBZfnIOoIHBb9IvVSkObcg+d4EW4Fr/p4STwr
EsFptBB2Il7nYf/OIs6DwqoMTpPRQoZ2XF7XXh94cFqx8kGz+k6FOe7AKDfpnLuV
BsSewVOYO9BlbIhecAXZkelaU5qOZISNUvGoXnZF3BfBdI6PpYFWTX6xQuVKh8Lm
onH0K4hMnzvOs0Iy5ZweN7o4hzMwsgQVjKG9jGAhxB/ybjwECRItPNzdm1pR+lZu
sPMfi6r6D1w=
=4r23
-----END PGP SIGNATURE-----