Vulmon
Description of Problem
A security vulnerability has been identified in XenServer 7.0 that may allow an attacker on the management network who is in possession of Active Directory credentials for an AD account that is not authorised to manage a XenServer host to compromise that host.
The following vulnerability has been addressed:
- CVE-2016-5302 (Low): Incorrect host management AD authentication
Mitigating Factors
Only XenServer 7.0 deployments that have been upgraded from earlier releases are affected. Earlier releases are unaffected, nor are new deployments of XenServer 7.0.
Only deployments where Active Directory has been continuously enabled from before the upgrade to XenServer 7.0 are affected. If Active Directory was disabled at the time of upgrade or has been disabled since, even if only briefly, the deployment is unaffected.
To exploit the vulnerability, an attacker requires access to the management network of the host XenServer. Citrix recommends that the XenServer management network is an isolated network.
What Customers Should Do
A hotfix has been released to address of this issue. Citrix recommends that affected customers install this hotfix, which can be downloaded from the following locations:
Citrix XenServer 7.0: CTX213769 – https://support.citrix.com/article/CTX213769
What Citrix Is Doing
Citrix is notifying customers and channel partners about this potential security issue. This article is also available from the Citrix Knowledge Center at http://support.citrix.com/.
Obtaining Support on This Issue
If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://www.citrix.com/support/open-a-support-case.html.
Reporting Security Vulnerabilities
Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For guidance on how to report security-related issues to Citrix, please see the following document: CTX081743 – Reporting Security Issues to Citrix