Vous êtes ici: index » cert » avis

Avis du CERT RENATER

Par défaut, cette page vous affichera les derniers messages envoyés par le CERT RENATER à la communauté. Vous pouvez affiner par année ou par type de message. Si aucun critère n'est précisé, seuls les derniers messages sont affichés

Date : Thu, 23 Oct 2014 17:51:50 +0200
Type : VULN
Sujet : CERT-Renater : 2014/VULN239 (Citrix : Citrix XenServer Shellshock Security Update)
====================================================================
                           CERT-Renater

               Note d'Information No. 2014/VULN239
_____________________________________________________________________

DATE                : 23/10/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Citrix XenServer versions all
                 supported up to and including Citrix XenServer 6.2 SP1.

======================================================================
http://support.citrix.com/article/CTX200223
______________________________________________________________________

Citrix XenServer Shellshock Security Update


CTX200223

Created on Sep 30, 2014

Updated on Oct 10, 2014

Severity: Medium


Description of Problem

A number of security vulnerabilities have been identified in the 'bash'
component of Citrix XenServer.  These issues include those known as
'Shellshock' and have the following identifiers: CVE-2014-6271,
CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186 and
CVE-2014-7187.

These issues affect all supported versions of Citrix XenServer up to and
including Citrix XenServer 6.2 Service Pack 1.

In deployments where the Citrix XenServer host is configured to use DHCP
for the host IP address allocation, this issue could allow an attacker
with access to the management network to compromise the Citrix XenServer
host.


Mitigating Factors

Customers that do not use DHCP to assign IP addresses to their Citrix
XenServer hosts are not at risk.


What Customers Should Do

Hotfixes have been released to address these issues. Citrix recommends
that affected customers install the relevant hotfixes, which can be
downloaded from the following locations:

* Citrix XenServer 6.2 Service Pack 1: CTX141486 - Hotfix XS62ESP1014 -
For XenServer 6.2.0 Service Pack 1

* Citrix XenServer 6.1: CTX141487- Hotfix XS61E044 - For XenServer 6.1.0

* Citrix XenServer 6.0.2: CTX141489 - Hotfix XS602E037 - For XenServer 6.0.2

* Customers using Citrix XenServer 6.0.2 in the Common Criteria
evaluated configuration should apply the following hotfix: CTX141488 -
Hotfix XS602ECC013 - For XenServer 6.0.2 Common Criteria

* Citrix XenServer 6.0: CTX141490 - Hotfix XS60E041 - For XenServer 6.0


What Citrix Is Doing

Citrix is notifying customers and channel partners about this potential
security issue. This article is also available from the Citrix Knowledge
Center at http://support.citrix.com/.


Obtaining Support on This Issue

If you require technical assistance with this issue, please contact
Citrix Technical Support. Contact details for Citrix Technical Support
are available at http://www.citrix.com/site/ss/supportContacts.asp.


Reporting Security Vulnerabilities

Citrix welcomes input regarding the security of its products and
considers any and all potential vulnerabilities seriously. For guidance
on how to report security-related issues to Citrix, please see the
following document:
CTX081743 – Reporting Security Issues to Citrix


Applicable Products

* XenServer 6.2.0
* XenServer 6.1.0
* XenServer 6.0.2
* XenServer 6.0

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================

[An attachment of type application/pkcs7-signature was included here]