Xen CVE-2013-4369 NULL pointer Dereference Remote Denial of Service Vulnerability

Bugtraq ID:	62931
Class:	Unknown
CVE:	CVE-2013-4369
Remote:	Yes
Local:	No
Published:	Oct 10 2013 12:00AM
Updated:	Apr 13 2015 10:16PM
Credit:	Coverity Scan and Matthew Daley
Vulnerable:	Xen Xen 4.3 Xen Xen 4.2 SuSE SUSE Linux Enterprise Software Development Kit 11 SP3 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 11 SP3 + Linux kernel 2.6.5 SuSE Suse Linux Enterprise Desktop 11 SP3 + Linux kernel 2.6.5 Gentoo Linux CentOS Xen4CentOS 0
Not Vulnerable:

Xen CVE-2013-4369 NULL pointer Dereference Remote Denial of Service Vulnerability

Xen is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to cause denial-of-service conditions.

Xen 4.2 and later versions are vulnerable.

Xen CVE-2013-4369 NULL pointer Dereference Remote Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Xen CVE-2013-4369 NULL pointer Dereference Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Xen CVE-2013-4369 NULL pointer Dereference Remote Denial of Service Vulnerability

References:

• libxl: fix vif rate parsing (Matthew Daley)
  
• Xen Project Homepage (Xen Project)
  
• Xen Security Advisory 68 - possible null dereference when parsing vif ratelimiti (oss-sec)