October 2014 - Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201410-5] rsyslog: remote denial of service
by Remi Gacogne 08 Oct '14

08 Oct '14

Arch Linux Security Advisory ASA-201410-5 ========================================= Severity: Medium Date : 2014-10-08 CVE-ID : CVE-2014-3683 Package : rsyslog Type : Denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package rsyslog before version 8.4.2-1 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 8.4.2-1. # pacman -Syu "rsyslog>=8.4.2-1" The problem has been fixed upstream in version 8.4.2. Workaround ========== It is possible to prevent unauthorized remote hosts from sending syslog messages to vulnerable hosts, for example by using a firewall. Description =========== The rsyslog fix shipped in 8.4.1 for an invalid PRI value (see ASA-201410-1) was incomplete, as it did not cover cases where PRI values > MAX_INT. These values caused an integer overflow, resulting in negative values. Sending a syslog message containing an invalid PRI value to a vulnerable rsyslog server accepting remote message will trigger a denial of service by crashing the rsyslog process. Impact ====== A remote attacker authorized to send syslog messages can cause the syslog server to segfault, causing a denial of service. According to the rsyslog project leader, under certain preconditions it may possibly lead to remote code execution [1]. The default configuration is safe from these preconditions. References ========== [1] http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3683

1 0

[arch-security] [Arch Linux Security Advisory ASA-201410-3] mediawiki: Cross-site Scripting (XSS) and UI redressing
by Levente Polyak 04 Oct '14

04 Oct '14

Arch Linux Security Advisory ASA-201410-3 ========================================= Severity: Medium Date : 2014-10-04 CVE-ID : CVE-2014-7295 Package : mediawiki Type : Cross-site Scripting (XSS) and UI redressing Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mediawiki before version 1.23.5-1 is vulnerable to Cross-site Scripting (XSS) and UI redressing. Resolution ========== Upgrade to 1.23.5-1. # pacman -Syu "mediawiki>=1.23.5-1" The problem has been fixed upstream in version 1.23.5. Workaround ========== None. Description =========== It was discovered that MediaWiki, a wiki engine, was separating the allowance of css and js modules resulting in Cross-site Scripting (XSS) and UI redressing issues. Impact ====== A remote attacker is able to perform Cross-site Scripting (XSS) and/or UI redressing attacks on affected MediaWiki pages. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7295 https://bugzilla.wikimedia.org/show_bug.cgi?id=70672 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-October/00016… http://www.openwall.com/lists/oss-security/2014/10/02/36

1 0

[arch-security] [Arch Linux Security Advisory ASA-201410-2] jenkins: multiple issues
by Remi Gacogne 02 Oct '14

02 Oct '14

Arch Linux Security Advisory ASA-201410-2 ========================================= Severity: Critical Date : 2014-10-02 CVE-ID : CVE-2013-2186 CVE-2014-1869 CVE-2014-3661 CVE-2014-3662 CVE-2014-3663 CVE-2014-3664 CVE-2014-3666 CVE-2014-3667 CVE-2014-3678 CVE-2014-3679 CVE-2014-3680 CVE-2014-3681 Package : jenkins Type : Multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package jenkins before version 1.583-1 is vulnerable to multiple vulnerabilities, including but not limited to: - denial of service ; - information leakage ; - privilege escalation ; - XSS ; - arbitrary file system write ; - remote code execution. Resolution ========== Upgrade to 1.583-1. # pacman -Syu "jenkins>=1.583-1" The problem has been fixed upstream in version 1.583. Workaround ========== None. Description =========== - SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake) This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion. - SECURITY-110/CVE-2014-3662 (User name discovery) Anonymous users can test if the user of a specific name exists or not through login attempts. - SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission) An user with a permission limited to Job/CONFIGURE can exploit this vulnerability to effectively create a new job, which should have been only possible for users with Job/CREATE permission, or to destroy jobs that he/she does not have access otherwise. - SECURITY-131/CVE-2014-3664 (directory traversal attack) Users with Overall/READ permission can access arbitrary files in the file system readable by the Jenkins process, resulting in the exposure of sensitive information, such as encryption keys. - SECURITY-138/CVE-2014-3680 (Password exposure in DOM) If a parameterized job has a default value in a password field, that default value gets exposed to users with Job/READ permission. - SECURITY-143/CVE-2014-3681 (XSS vulnerability in Jenkins core) Reflected cross-site scripting vulnerability in Jenkins core. An attacker can navigate the user to a carefully crafted URL and have the user execute unintended actions. - SECURITY-150/CVE-2014-3666 (remote code execution from CLI) Unauthenticated user can execute arbitrary code on Jenkins master by sending carefully crafted packets over the CLI channel. - SECURITY-155/CVE-2014-3667 (exposure of plugin code) Programs that constitute plugins can be downloaded by anyone with the Overall/READ permission, resulting in the exposure of otherwise sensitive information, such as hard-coded keys in plugins, if any. - SECURITY-159/CVE-2013-2186 (arbitrary file system write) Security vulnerability in commons fileupload allows unauthenticated attacker to upload arbitrary files to Jenkins master. - SECURITY-149/CVE-2014-1869 (XSS vulnerabilities in ZeroClipboard) reflective XSS vulnerability in one of the library dependencies of Jenkins. - SECURITY-113/CVE-2014-3678 (XSS vulnerabilities in monitoring plugin) Monitoring plugin allows an attacker to cause a victim into executing unwanted actions on Jenkins instance. - SECURITY-113/CVE-2014-3679 (hole in access control) Certain pages in monitoring plugin are visible to anonymous users, allowing them to gain information that they are not supposed to. Impact ====== A remote, non-privileged attacker can execute arbitrary code, read and write arbitrary files and trick valid users into doing unwanted actions. References ========== https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1869 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3661 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3662 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3663 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3664 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3666 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3667 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3678 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3679 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3680 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3681

1 0

[arch-security] [Arch Linux Security Advisory ASA-201410-1] rsyslog: remote denial of service
by Remi Gacogne 01 Oct '14

01 Oct '14

Arch Linux Security Advisory ASA-201410-1 ========================================= Severity: Medium Date : 2014-10-01 CVE-ID : CVE-2014-3634 Package : rsyslog Type : Denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package rsyslog before version 8.4.1-1 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 8.4.1-1. # pacman -Syu "rsyslog>=8.4.1-1" The problem has been fixed upstream in version 8.4.1. Workaround ========== It is possible to prevent unauthorized remote hosts from sending syslog messages to vulnerable hosts, for example by using a firewall. Description =========== Sending a syslog message containing an invalid PRI value to a vulnerable rsyslog server accepting remote message will trigger a denial of service by crashing the rsyslog process. Impact ====== A remote attacker authorized to send syslog messages can cause the syslog server to segfault, causing a denial of service. According to the rsyslog project leader, under certain preconditions it may possibly lead to remote code execution [1]. The default configuration is safe from these preconditions. References ========== [1] http://www.rsyslog.com/remote-syslog-pri-vulnerability/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3634 https://bugs.archlinux.org/task/42200

1 0