December 2014 - Arch-security - lists.archlinux.org

[arch-security] systemd
by Xan 22 Dec '14

22 Dec '14

Hi, Perhaps someone could be insterested in those: http://soylentnews.org/article.pl?sid=14/12/21/1343258 You're welcome,

3 3

[arch-security] [ASA-201412-24] ntp: multiple issues
by Levente Polyak 22 Dec '14

22 Dec '14

Arch Linux Security Advisory ASA-201412-24 ========================================== Severity: Critical Date : 2014-12-22 CVE-ID : CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package ntp before version 4.2.8-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service and weak key generation. Resolution ========== Upgrade to 4.2.8-1. # pacman -Syu "ntp>=4.2.8-1" The problems have been fixed upstream in version 4.2.8. Workaround ========== None. Description =========== Keys explicitly generated by "ntp-keygen -M" should be regenerated. - CVE-2014-9293 (weak key generation) ntpd generated a weak key for its internal use, with full administrative privileges. Attackers could use this key to reconfigure ntpd (or to exploit other vulnerabilities). - CVE-2014-9294 (weak key generation) The ntp-keygen utility generated weak MD5 keys with insufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. - CVE-2014-9295 (arbitrary code execution) Multiple stack-based buffer overflows in allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function. - CVE-2014-9296 (unintended association change) The receive function in ntp_proto.c continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets. Impact ====== A remote attacker is able to craft packets leading to arbitrary code execution, denial of service or make use of a weak key generation flaw to perform cryptographic attacks against the authentication. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9293 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9294 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9295 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9296 https://bugs.ntp.org/show_bug.cgi?id=2665 https://bugs.ntp.org/show_bug.cgi?id=2666 https://bugs.ntp.org/show_bug.cgi?id=2667 https://bugs.ntp.org/show_bug.cgi?id=2670

1 0

[arch-security] Git client vulnerability
by Matthew Jack 22 Dec '14

22 Dec '14

Hello all, I haven't seen anything about this in the mailing list but I think it's interesting - and important for developers: https://github.com/blog/1938-git-client-vulnerability-announced Happy holidays!

2 1

[arch-security] [ASA-201412-23] php: use after free
by Levente Polyak 19 Dec '14

19 Dec '14

Arch Linux Security Advisory ASA-201412-23 ========================================== Severity: Moderate Date : 2014-12-19 CVE-ID : CVE-2014-8142 Package : php Type : use after free Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package php before version 5.6.4-1 is suffering from a use after free flaw leading to denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 5.6.4-1. # pacman -Syu "php>=5.6.4-1" The problem has been fixed in version 5.6.4. Workaround ========== None. Description =========== A use-after-free flaw was found in PHP unserialize(). An untrusted input could cause PHP interpreter to crash or, possibly, execute arbitrary code when processed using unserialize(). Impact ====== A remote attacker able to pass crafted data to the unserialize function is able to force a crash or possibly execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2014-8142 https://bugzilla.redhat.com/show_bug.cgi?id=1175718 https://bugs.php.net/bug.php?id=68545

1 0

[arch-security] [ASA-201412-22] jasper: arbitrary code execution
by Levente Polyak 19 Dec '14

19 Dec '14

Arch Linux Security Advisory ASA-201412-22 ========================================== Severity: Critical Date : 2014-12-19 CVE-ID : jasper Package : CVE-2014-8137 CVE-2014-9029 CVE-2011-4516 CVE-2011-4517 Type : arbitrary code execution, denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package jasper before version 1.900.1-12 is vulnerable to arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.900.1-12. # pacman -Syu "jasper>=1.900.1-12" The problems have not been fixed upstream but patches were added. Workaround ========== None. Description =========== - CVE-2014-8137 (arbitrary code execution) A double free flaw was found in the way JasPer parsed ICC color profiles in JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. - CVE-2014-9029 (arbitrary code execution) Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow. - CVE-2011-4516 (arbitrary code execution) Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file. - CVE-2011-4517 (arbitrary code execution) The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file. Impact ====== An attacker is able to execute arbitrary code or perform a denial of service attack via various vulnerabilities. References ========== https://marc.info/?l=oss-security&m=141770163916268&w=2 https://marc.info/?l=oss-security&m=141891163026757&w=2 https://access.redhat.com/security/cve/CVE-2014-8137 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9029 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4516 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4517 https://bugs.archlinux.org/task/43044 https://bugs.archlinux.org/task/43155

1 0

[arch-security] [ASA-201412-21] glibc: arbitrary code execution
by Levente Polyak 19 Dec '14

19 Dec '14

Arch Linux Security Advisory ASA-201412-21 ========================================== Severity: High Date : 2014-12-18 CVE-ID : CVE-2012-3406 CVE-2014-9402 Package : glibc lib32-glibc Type : arbitrary code execution, denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The packages glibc and lib32-glibc before version 2.20-5 are vulnerable to arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.20-5. # pacman -Syu "glibc>=2.20-5" # pacman -Syu "lib32-glibc>=2.20-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-3406 (arbitrary code execution) The vfprintf function in stdio-common/vfprintf.c in GNU C Library does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers. - CVE-2014-9402 (denial of service) The nss_dns getnetbyname function will enter an infinite loop if the DNS backend is activated in the system Name Service Switch configuration and the DNS resolver receives a positive answer while processing the network name. Impact ====== An attacker is able to perform a denial of service attack or execute arbitrary code via crafted format strings. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3406 https://access.redhat.com/security/cve/CVE-2014-9402 https://sourceware.org/bugzilla/show_bug.cgi?id=17630 http://www.openwall.com/lists/oss-security/2014/12/18/1

1 0

[arch-security] Privelege escalation via Wheel + PolKit
by Mark Lee 17 Dec '14

17 Dec '14

To all, This was just posted on oss-security; I figure it's a good read. https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/ Regards, Mark

1 1

[arch-security] [ASA-201412-20] unrtf: arbitrary code execution
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-20 ========================================== Severity: High Date : 2014-12-16 CVE-ID : CVE-2014-9274 CVE-2014-9275 Package : unrtf Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package unrtf before version 0.21.7-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.21.7-1. # pacman -Syu "unrtf>=0.21.7-1" The problems have been fixed upstream in version 0.21.7. Workaround ========== None. Description =========== - CVE-2014-9274 (arbitrary code execution) A flaw allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999". - CVE-2014-9275 (arbitrary code execution) A flaw allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file. Impact ====== An attacker able to craft a RTF file could use those issues to cause a crash or execute arbitrary code while accessing a pointer that may be under the attacker's control. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9274 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9275 https://bugzilla.redhat.com/show_bug.cgi?id=1170233 http://seclists.org/oss-sec/2014/q4/904 https://bugs.archlinux.org/task/43131

1 0

[arch-security] [ASA-201412-19] dokuwiki: cross-site scripting
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-19 ========================================== Severity: Medium Date : 2014-12-16 CVE-ID : CVE-2014-9253 Package : dokuwiki Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package dokuwiki before version 20140929_b-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 20140929_b-1. # pacman -Syu "dokuwiki>=20140929_b-1" The problem has been fixed upstream in version 20140929_b. Workaround ========== None. Description =========== It was discovered that dokuwiki did not sufficiently filter uploaded files. A remote attacker with upload access is able to use this flaw in order to upload SWF files leading to possible cross-site scripting. Impact ====== A remote attacker with upload access is able to craft a SWF file to perform a cross-site scripting attack. References ========== https://access.redhat.com/security/cve/CVE-2014-9253 http://seclists.org/oss-sec/2014/q4/1050 https://www.dokuwiki.org/changes#release_2014-09-29b_hrun https://github.com/splitbrain/dokuwiki/commit/778ddf

1 0

[arch-security] [ASA-201412-18] nss: signature forgery
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-18 ========================================== Severity: High Date : 2014-12-16 CVE-ID : CVE-2014-1569 Package : nss Type : signature forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package nss before version 3.17.3-1 is vulnerable to signature forgery. Resolution ========== Upgrade to 3.17.3-1. # pacman -Syu "nss>=3.17.3-1" The problem has been fixed upstream in version 3.17.3. Workaround ========== None. Description =========== The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00. This update also adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566, also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE. Impact ====== A remote attacker is able to smuggle arbitrary data into an ASN.1 object in order to forge certificates that are considered trusted. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1569 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_re… https://hg.mozilla.org/projects/nss/rev/e9a7991380db https://bugzilla.mozilla.org/show_bug.cgi?id=1064670 https://bugs.archlinux.org/task/42760

1 0