CVE-2009-3525
Severity CVSS v4.0:
Pending analysis
Type:
CWE-264
Permissions, Privileges, and Access Control
Publication date:
05/10/2009
Last modified:
19/09/2017
Description
The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
Impact
Base Score 2.0
7.20
Severity 2.0
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:xen:xen:3.0.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:xen:xen:3.3.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:xen:xen:3.3.1:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
- http://secunia.com/advisories/36908
- http://www.openwall.com/lists/oss-security/2009/09/25/1
- http://www.redhat.com/support/errata/RHSA-2009-1472.html
- http://www.securityfocus.com/bid/36523
- http://www.securitytracker.com/id?1022950=
- http://xenbits.xensource.com/xen-unstable.hg?rev%2F8f783adc0ee3=
- https://bugzilla.redhat.com/show_bug.cgi?id=525740
- https://bugzilla.redhat.com/show_bug.cgi?id=525740#c0
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9466