Test ID:	1.3.6.1.4.1.25623.1.0.105296
Category:	Citrix Xenserver Local Security Checks
Title:	Citrix XenServer Multiple Security Updates (CTX201145)
Summary:	A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator; of a guest VM to crash the host. These vulnerabilities affect all currently supported versions of Citrix XenServer up to and including; Citrix XenServer 6.5 Service Pack 1.
Description:	Summary: A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to crash the host. These vulnerabilities affect all currently supported versions of Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1. Vulnerability Insight: The following vulnerabilities have been addressed: - CVE-2015-4106: Unmediated PCI register access in qemu. - CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior. - CVE-2015-4164: vulnerability in the iret hypercall handler - CVE-2015-2756: Unmediated PCI command register access in qemu - CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. - CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. - CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages Affected Software/OS: XenServer 6.5 XenServer 6.2.0 XenServer 6.0 XenServer 6.0.2 XenServer 6.1.0 Solution: Apply the hotfix referenced in the advisory. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-4106 BugTraq ID: 74949 http://www.securityfocus.com/bid/74949 Debian Security Information: DSA-3284 (Google Search) http://www.debian.org/security/2015/dsa-3284 Debian Security Information: DSA-3286 (Google Search) http://www.debian.org/security/2015/dsa-3286 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html https://security.gentoo.org/glsa/201604-03 http://www.securitytracker.com/id/1032467 SuSE Security Announcement: SUSE-SU-2015:1042 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html SuSE Security Announcement: SUSE-SU-2015:1045 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html SuSE Security Announcement: SUSE-SU-2015:1156 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html SuSE Security Announcement: SUSE-SU-2015:1157 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html http://www.ubuntu.com/usn/USN-2630-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-4163 BugTraq ID: 75141 http://www.securityfocus.com/bid/75141 http://www.securitytracker.com/id/1032568 Common Vulnerability Exposure (CVE) ID: CVE-2015-4164 BugTraq ID: 75149 http://www.securityfocus.com/bid/75149 http://www.securitytracker.com/id/1032569 SuSE Security Announcement: SUSE-SU-2015:1206 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00014.html SuSE Security Announcement: SUSE-SU-2015:1643 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.html Common Vulnerability Exposure (CVE) ID: CVE-2015-2756 BugTraq ID: 72577 http://www.securityfocus.com/bid/72577 Debian Security Information: DSA-3259 (Google Search) http://www.debian.org/security/2015/dsa-3259 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html https://security.gentoo.org/glsa/201504-04 http://lists.nongnu.org/archive/html/qemu-devel/2015-03/msg06179.html http://www.securitytracker.com/id/1031998 SuSE Security Announcement: openSUSE-SU-2015:0732 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html http://www.ubuntu.com/usn/USN-2608-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-4103 BugTraq ID: 74947 http://www.securityfocus.com/bid/74947 http://www.securitytracker.com/id/1032456 Common Vulnerability Exposure (CVE) ID: CVE-2015-4104 BugTraq ID: 74950 http://www.securityfocus.com/bid/74950 http://www.securitytracker.com/id/1032464 Common Vulnerability Exposure (CVE) ID: CVE-2015-4105 BugTraq ID: 74948 http://www.securityfocus.com/bid/74948 http://www.securitytracker.com/id/1032465
Copyright	Copyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.