Vous êtes ici: index » cert » avis


Par défaut, cette page vous affichera les derniers messages envoyés par le CERT RENATER à la communauté. Vous pouvez affiner par année ou par type de message. Si aucun critère n'est précisé, seuls les derniers messages sont affichés

Date : Thu, 23 Oct 2014 17:51:50 +0200
Type : VULN
Sujet : CERT-Renater : 2014/VULN239 (Citrix : Citrix XenServer Shellshock Security Update)

               Note d'Information No. 2014/VULN239

DATE                : 23/10/2014


OPERATING SYSTEM(S): Systems running Citrix XenServer versions all
                 supported up to and including Citrix XenServer 6.2 SP1.


Citrix XenServer Shellshock Security Update


Created on Sep 30, 2014

Updated on Oct 10, 2014

Severity: Medium

Description of Problem

A number of security vulnerabilities have been identified in the 'bash'
component of Citrix XenServer.  These issues include those known as
'Shellshock' and have the following identifiers: CVE-2014-6271,
CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186 and

These issues affect all supported versions of Citrix XenServer up to and
including Citrix XenServer 6.2 Service Pack 1.

In deployments where the Citrix XenServer host is configured to use DHCP
for the host IP address allocation, this issue could allow an attacker
with access to the management network to compromise the Citrix XenServer

Mitigating Factors

Customers that do not use DHCP to assign IP addresses to their Citrix
XenServer hosts are not at risk.

What Customers Should Do

Hotfixes have been released to address these issues. Citrix recommends
that affected customers install the relevant hotfixes, which can be
downloaded from the following locations:

* Citrix XenServer 6.2 Service Pack 1: CTX141486 - Hotfix XS62ESP1014 -
For XenServer 6.2.0 Service Pack 1

* Citrix XenServer 6.1: CTX141487- Hotfix XS61E044 - For XenServer 6.1.0

* Citrix XenServer 6.0.2: CTX141489 - Hotfix XS602E037 - For XenServer 6.0.2

* Customers using Citrix XenServer 6.0.2 in the Common Criteria
evaluated configuration should apply the following hotfix: CTX141488 -
Hotfix XS602ECC013 - For XenServer 6.0.2 Common Criteria

* Citrix XenServer 6.0: CTX141490 - Hotfix XS60E041 - For XenServer 6.0

What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential
security issue. This article is also available from the Citrix Knowledge
Center at http://support.citrix.com/.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at http://www.citrix.com/site/ss/supportContacts.asp.

Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. For guidance
on how to report security-related issues to Citrix, please see the
following document:
CTX081743 – Reporting Security Issues to Citrix

Applicable Products

* XenServer 6.2.0
* XenServer 6.1.0
* XenServer 6.0.2
* XenServer 6.0

Serveur de référence du CERT-Renater
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +

[An attachment of type application/pkcs7-signature was included here]