Executive brief
Citrix XenServer is a virtualization platform used to manage and run virtual machines. A vulnerability in the management interface allows a user with restricted, read-only administrative access to corrupt the host database. This could lead to a loss of system integrity or a service outage, as the database is critical for the server's operation.
Technical details
A privilege management vulnerability (CWE-269) exists in the Linux Foundation xapi component of Citrix XenServer versions up to and including 7.0. The flaw allows an attacker who has already obtained high-privileged, read-only administrative credentials to perform unauthorized write operations that corrupt the host database. The attack can be carried out over the network without user interaction. Successful exploitation results in high impacts to system integrity and availability, though it does not directly lead to data confidentiality loss. Citrix addressed this issue in advisory CTX220112.
Affected products
- Citrix XenServer through 7.0
- Linux Foundation xapi
Timeline
- 2017-01-30: disclosed
- 2017-01-30: advisory