CVE

Id
35833  
CVE No.
CVE-2008-5716  
Status
Candidate  
Description
xend in Xen 3.3.0 does not properly restrict a guest VM"s write access within the /local/domain xenstore directory tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue exists because of erroneous set_permissions calls in the fix for CVE-2008-4405.  
Phase
Assigned (20081224)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
393968 35833 CVE-2008-5716 MLIST:[oss-security] 20081219 CVE Request -- Xen (Upstream patch for CVE-2008-4405 is incomplete)  View
393969 35833 CVE-2008-5716 URL:http://openwall.com/lists/oss-security/2008/12/19/1  View
393970 35833 CVE-2008-5716 MLIST:[xen-devel] 20081218 PATCH: Actually make /local/domain/$DOMID readonly to the guest  View
393971 35833 CVE-2008-5716 URL:http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00842.html  View
393972 35833 CVE-2008-5716 MLIST:[xen-devel] 20081218 Re: PATCH: Actually make /local/domain/$DOMID readonly to the guest  View
393973 35833 CVE-2008-5716 URL:http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00845.html  View
393974 35833 CVE-2008-5716 MLIST:[xen-devel] 20081218 Re: PATCH: Actually make /local/domain/$DOMID readonly to the guest  View
393975 35833 CVE-2008-5716 URL:http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00846.html  View
393976 35833 CVE-2008-5716 MLIST:[xen-devel] 20081218 Re: PATCH: Actually make /local/domain/$DOMID readonly to the guest  View
393977 35833 CVE-2008-5716 URL:http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00847.html  View
393978 35833 CVE-2008-5716 BID:31499  View
393979 35833 CVE-2008-5716 URL:http://www.securityfocus.com/bid/31499  View
393980 35833 CVE-2008-5716 XF:xen-xend-xenstore-dos(47668)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
45689 JVNDB-2008-000085 Mayaa におけるクロスサイトスクリプティングの脆弱性 Seasar プロジェクトが提供する Java 用テンプレートエンジンである Mayaa には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2008-5720 35833 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000085.html  View