Xen 3.0.3 - pygrub TOOLS/PYGRUB/SRC/GRUBCONF.PY Local Command Injection

Author: Joris van Rantwijk
type: local
platform: linux
port: 
date_added: 2007-09-22 
date_updated: 2014-01-02 
verified: 1 
codes: CVE-2007-4993;OSVDB-41340 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/25825/info

Xen is prone to a local command-injection vulnerability that can lead to privilege escalation.

This issue occurs because the application fails to validate input in the 'tools/pygrub/src/GrubConf.py' script.

This vulnerability affects Xen 3.0.3; other versions may be affected as well.

An attacker can exploit this issue by including Python commands in a configuration file using filesystem utilities. The following proof of concept is available:

Change the 'default' statement in grub.conf to:
default "+str(0*os.system(" insert evil command here "))+"