Vulnerability Description
pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest domain to execute arbitrary commands in domain 0 via a crafted grub.conf file whose contents are used in exec statements.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xensource Inc | Xen | 3.0.3 |
Related Weaknesses (CWE)
References
- http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1068
- http://secunia.com/advisories/26986Vendor Advisory
- http://secunia.com/advisories/27047
- http://secunia.com/advisories/27072
- http://secunia.com/advisories/27085
- http://secunia.com/advisories/27103
- http://secunia.com/advisories/27141
- http://secunia.com/advisories/27161
- http://secunia.com/advisories/27486
- http://www.debian.org/security/2007/dsa-1384
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:203
- http://www.redhat.com/support/errata/RHSA-2007-0323.html
- http://www.securityfocus.com/archive/1/481825/100/0/threaded
- http://www.securityfocus.com/bid/25825
- http://www.ubuntu.com/usn/usn-527-1
FAQ
What is CVE-2007-4993?
CVE-2007-4993 is a vulnerability with a CVSS score of 6.9 (MEDIUM). pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest domain to execute arbitrary commands in domain 0 via a crafted...
How severe is CVE-2007-4993?
CVE-2007-4993 has been rated MEDIUM with a CVSS base score of 6.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-4993?
Check the references section above for vendor advisories and patch information. Affected products include: Xensource Inc Xen.