=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN025
_____________________________________________________________________

DATE                : 23/01/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix XenServer version 5.6, 6.x.

======================================================================
http://support.citrix.com/article/CTX140038
______________________________________________________________________

 Citrix XenServer Multiple Security Updates

Document ID: CTX140038   /   Created On: 21 janv. 2014   /   Updated On:
21 janv. 2014


Severity: Low


Description of Problem

A number of security vulnerabilities have been identified in Citrix
XenServer. These vulnerabilities affect all currently supported
versions of Citrix XenServer up to and including Citrix XenServer 6.2
Service Pack 1.

The following vulnerabilities have been addressed:

    • CVE-2013-4494: Lock order reversal between page allocation and
                     grant

    • CVE-2013-4554: Hypercalls exposed to privilege rings 1 and 2 of
                     HVM guests

    • CVE-2013-6885: Guest triggerable AMD CPU erratum may cause host
                     hang


What Customers Should Do

Hotfixes have been released to address these issues. Citrix recommends
that affected customers install the relevant hotfix, which can be
downloaded from the following locations:

Citrix XenServer 6.2 Service Pack 1: CTX140051 – Hotfix XS62ESP1002 -
For XenServer 6.2.0 Service Pack 1

Citrix XenServer 6.2: CTX140052 – Hotfix XS62E014 - For XenServer 6.2.0

Citrix XenServer 6.1: CTX140053 – Hotfix XS61E036 - For XenServer 6.1.0

Citrix XenServer 6.0.2: CTX140055 – Hotfix XS602E032 - For XenServer 6.0.2

Customers using Citrix XenServer 6.0.2 in the Common Criteria evaluated
configuration should apply the following hotfix: CTX140054 – Hotfix
XS602ECC008 - For XenServer 6.0.2 Common Criteria

Citrix XenServer 6.0.0: CTX140056 – Hotfix XS60E037 - For XenServer 6.0

Citrix XenServer 5.6 Service Pack 2: CTX140057 – Hotfix XS56ESP2034 -
For XenServer 5.6 Service Pack 2

Citrix XenServer 5.6 Feature Pack 1: CTX140058 – Hotfix XS56EFP1022 -
For XenServer 5.6 Feature Pack 1

Citrix XenServer 5.6: CTX140060 – Hotfix XS56E023 - For XenServer 5.6

Customers using Citrix XenServer 5.6 in the Common Criteria evaluated
configuration should apply the following hotfix:
CTX140059 – Hotfix XS56ECC011 - For XenServer 5.6 Common Criteria


What Citrix Is Doing

Citrix is notifying customers and channel partners about these
potential security issues. This article is also available from the
Citrix Knowledge Center at http://support.citrix.com/


Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at http://www.citrix.com/site/ss/supportContacts.asp.


Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. If you would
like to report a security issue to Citrix, please compose an e-mail to
secure@citrix.com stating the exact version of the product in which the
vulnerability was found and the steps needed to reproduce the
vulnerability.

This document applies to:

    XenServer 5.6
    XenServer 5.6 Common Criteria
    XenServer 5.6 FP 1
    XenServer 5.6 SP 2
    XenServer 6.0
    XenServer 6.0.2
    XenServer 6.0.2 Common Criteria
    XenServer 6.1.0
    XenServer 6.2.0

=========================================================
Serveur de rιfιrence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================