Citrix XenServer Multiple Security Updates

Several security issues have been identified within Citrix XenServer. These issues could, if exploited, allow an authenticated administrator to perform a denial-of-service attack against the host, even when that administrator has a less-privileged RBAC role (e.g. read-only).  In addition, the issues could permit an attacker with the ability to influence NTP traffic on the management network to disrupt time synchronization on the host until the next reboot.

The following vulnerabilities have been addressed:

• CVE-2017-5572 (Low): Authenticated read-only administrator can corrupt host database
• CVE-2017-5573 (Low): Authenticated read-only administrator can cancel tasks of other administrators
• CVE-2015-5300, CVE-2015-7704, CVE-2015-7705 (Low): NTP updates

Customers who have not enabled NTP are unaffected by the NTP issues.

Customers who have not enabled RBAC are unaffected by the RBAC issues.

Customers using Citrix XenServer 6.0.2 in the Common Criteria configuration are unaffected by the RBAC issues.

Hotfixes have been released to address these issues. Citrix recommends that affected customers install these hotfixes, which can be downloaded from the following locations:

Citrix XenServer 7.0: CTX220081 – https://support.citrix.com/article/CTX220081 and CTX220244 – https://support.citrix.com/article/CTX220244 

Citrix XenServer 6.5 SP1: CTX220080 – https://support.citrix.com/article/CTX220080 and CTX220243 – https://support.citrix.com/article/CTX220243 

Citrix XenServer 6.2 SP1: CTX220079 – https://support.citrix.com/article/CTX220079 and CTX220242 – https://support.citrix.com/article/CTX220242 

Citrix XenServer 6.0.2 Common Criteria: CTX220078 – https://support.citrix.com/article/CTX220078