similar to: Bug#447795: xen-utils-3.0.3-1: [CVE-2007-3919] xenmon.py / xenbaked insecure file accesss

Source: xen-unstable Version: 3.0-unstable+hg11561-1 Severity: grave Tags: security Hi, the following CVE (Common Vulnerabilities & Exposures) id was published for xen-unstable. CVE-2007-3919[0]: | (1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local | users to truncate arbitrary files via a symlink attack on | /tmp/xenq-shm. If you fix this vulnerability please also include

Processing commands for control at bugs.debian.org: > # Automatically generated email from bts, devscripts version 2.9.26 > found 447795 3.0.3-0-1 Bug#447795: xen-utils-3.0.3-1: [CVE-2007-3919] xenmon.py / xenbaked insecure file accesss Bug marked as found in version 3.0.3-0-1. > End of message, stopping processing here. Please contact me if you need assistance. Debian bug tracking

Processing commands for control at bugs.debian.org: > # Automatically generated email from bts, devscripts version 2.10.12 > fixed 447795 3.0.3-0-4 Bug#447795: xen-utils-3.0.3-1: [CVE-2007-3919] xenmon.py / xenbaked insecure file accesss Bug marked as fixed in version 3.0.3-0-4. > End of message, stopping processing here. Please contact me if you need assistance. Debian bug tracking

Package: xen-utils-3.0.3-1 Version: 3.0.3-0-2 For some reason, xenmon.py is not in the search path - maybe an issue of the wrapper used by the xen Debian packages seems to be only a link to the wrapper is missing the program exists in the package xen-utils-3.0.3-0-2 and the follwoing make it work: ln -s ../lib/xen-common/bin/xen-utils-wrapper /usr/sbin/xenmon.py ln -s

Attached is the second release of XenMon, which is a unique performance monitoring tool for Xen. Instead of using hypervisor calls to get domain information, we use the xentrace facility to provide fine-grained monitoring of various metrics (see README below). We have written up a small case study that demonstrates the usefulness of the tool and the metrics that it reports. This will be

Processing commands for control at bugs.debian.org: > # Automatically generated email from bts, devscripts version 2.9.26 > reassign 447795 xen-3.0 3.0.3-0-3 Bug#447795: xen-utils-3.0.3-1: [CVE-2007-3919] xenmon.py / xenbaked insecure file accesss Bug reassigned from package `xen-utils-3.0.3-1' to `xen-3.0'. > End of message, stopping processing here. Please contact me if you

Cycling around many CPUs in XenMon''s curses mode can get cumbersome. This trivial patch adds bindings to move to the previous CPU. The next/previous binding seems more natural to me than the earlier cycle binding, but we can keep them all for now. # HG changeset patch # Node ID 146b5c76086c07fad61bea7ccf60f2f4fd66abbd # Parent 7dd31dbf16e75f0f70e0f9c44b2bb2b5fc6eecf1 Add next/previous

# HG changeset patch # User john.levon@sun.com # Date 1155596263 -3600 # Node ID dc12f0942649ee27ff2aec3e3d9c2d99746b9e58 # Parent 09bc238664cb7b6d0f960f5e135ac80a75b342f1 Remove another external-to-libxc user of xc_dom0_op(). Signed-off-by: John Levon <john.levon@sun.com> diff -r 09bc238664cb -r dc12f0942649 tools/xenmon/xenbaked.c --- a/tools/xenmon/xenbaked.c Mon Aug 14 15:40:36 2006

Once Xen calculates nr_nodes properly, all nr_cpu calculations based on nr_nodes * sockets_per_node * cores_per_socket * threads_per_core are broken. The easy fix is to replace those calculations with a new field, nr_cpus in physinfo which is calculated by num_online_cpus(). This patch does so and attempts to change all users over to nr_cpus field in physinfo. This patch touches

Hi, Xenmon does not work correctlly after xentrace changes in cs 17000. Attached patch fixes this problem. This patch modifies access to trace buffer same as tools/xentrace. Signed-off-by: Naoki Nishiguchi <nisiguti@jp.fujitsu.com> Regards, Naoki Nishiguchi _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com

Hi, I read about RPC interface for xenmon in this presentation: www.xensource.com/files/xs0106_xenmon_brief.pdf Has such interface been implemented yet by anyone? Thanks, -- Jayesh ------------------------------------------------------------------------ Everything you can imagine is real _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com

Hi, All This is a patch for xentrace.c. This routine checks the trace buffer is initialized or not. If not, the trace buffer is initialized by using this patch. This is avoiding following message. ERROR: Failure to get trace buffer pointer from Xen (22 = Invalid argument) This routine is based on the specification of the trace buffer control function trace.c/tb_control(). The function checks

Package: xen-utils-4.1 Version: 4.1.4-4 Severity: normal User: mayhem at forallsecure.com Usertags: mayhem xenbaked crashes with exit status 139. We confirmed the crash by re-running it in a fresh debian unstable installation. The attachment [1] contains a testcase (under ./crash) crashing the program. It ensures that you can easily reproduce the bug. Additionally, under ./crash_info/, we

Hi, This patch removes the magic number "31" for readability. The number "31" means the idle domain ID. In detail: - display the idle domain ID with "Idle" instead of "31" - write to the file "log-idle.log" instead of "log-dom31.log". Signed-off-by: KUWAMURA Shin''ya <kuwa@jp.fujitsu.com> Thanks, -- KUWAMURA

Hi, This patch adds the argument check of "--ms_per_sample=" option. For "--ms_per_sample=", a negative value should be invalid. e.g. % xenmon.py -n --ms_per_sample=-1 usage: xenmon.py [options] xenmon.py: error: option --ms_per_sample: invalid negative value: ''-1'' Signed-off-by: KUWAMURA Shin''ya <kuwa@jp.fujitsu.com> -- KUWAMURA

Hi, All! This is a patch which needs discussion. Currently xc_tbuf_enable assumed tb_init_done = 0. But Sometimes already on For example(xenmon.py(xenbaked) and xentrace). These two programs assues tb_init_done =0 at start time. Currently xenbaked care the problem by setting tb_init_done=0 at exit time. But xentrace does not care the problem. Then error occured!(Cannot see the trace

Hi, I am using Xenmon to measure performance of Credit and SEDF schedulers. But as you know, the metrics displayed by xenmon keep refreshing on the screen. When I tried redirecting the xenmon output, I am seeing the attached file. Is there any better way to record results which I can use to draw graphs? Please guide.. Thank you Warm Regards Ananth

Hi, I am using Xenmon to measure performance of Credit and SEDF schedulers. But as you know, the metrics displayed by xenmon keep refreshing on the screen. When I tried redirecting the xenmon output, I am seeing the attached file. Is there any better way to record results which I can use to draw graphs? Please guide.. Thank you Warm Regards Ananth

Hi all, I installed SLES 10.0b3 with XEN on some test-systems and created a SLES 10.0b3-image for use with domU''s. The installation and booting of this domU was no problem, but on some systems the host dom0 restarts if I generate some IP-traffic from the guest. This happens on an old AMD Athlon 1,3GHz, an old Intel P3 and an Intel desktop with P4 HT/VT/EM64T but not on an Intel

Hi, We found a crash in xenbaked contained in the xen-utils-4.1 package. You are being contacted because your are listed as one of the maintainer of xen-utils-4.1. We are planning to submit the bug to the Debian bug tracking system in two weeks. We wanted to give you a heads-up, so that you some time to assess the seriousness of the bug before it is publicly disclosed. The bug report that will