CVE-2009-4011

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-09 · updated 2026-06-16
Weakness: CWE-362

Description

dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a potentially reuse an already opened VPS console.

Affected products

Dtc-Xen Project Dtc-Xen: from 0.5.0 before 0.5.4 — fixed in 0.5.4

How to fix

Upgrade to a fixed version: Dtc-Xen Project Dtc-Xen 0.5.4. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/ubuntu/+source/dtc-xen/+bug/505072
https://security-tracker.debian.org/tracker/CVE-2009-4011
https://tracker.debian.org/media/packages/d/dtc-xen/changelog-0.5.17-1.1
https://bugs.launchpad.net/ubuntu/+source/dtc-xen/+bug/505072
https://security-tracker.debian.org/tracker/CVE-2009-4011
https://tracker.debian.org/media/packages/d/dtc-xen/changelog-0.5.17-1.1

Get alerted when CVE-2009-4011 or the next vulnerability affects your stack