CVE-2009-3525

Name	CVE-2009-3525
Description	The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
xen-3	source	(unstable)	(unfixed)	unimportant
xen-unstable	source	(unstable)	(unfixed)	unimportant

Notes

This is an enhancement, not a security issue.
A user must have access to a guest hard drive image in order to boot it,
so he can simply mount the drive and remove the password option.