#VU14474 Path traversal in Xen - CVE-2018-14007

Vulnerability identifier: #VU14474

Vulnerability risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-14007

CWE-ID: CWE-22

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Xen
Server applications / Virtualization software

Vendor: Xen Project

Description

The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to path traversal. An adjacent attacker can conduct directory traversal attack and read arbitrary files from the dom0 filesystem  including the pool secret /etc/xensource/ptoken which grants the attacker full administrator.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Xen: 4.6.0 - 4.11.0

---

External links
https://xenbits.xen.org/xsa/advisory-271.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.