December 2014 - Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201412-7] bind: denial of service
by Levente Polyak 08 Dec '14

08 Dec '14

Arch Linux Security Advisory ASA-201412-7 ========================================= Severity: High Date : 2014-12-08 CVE-ID : CVE-2014-8500 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package bind before version 9.10.1.P1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.1.P1-1. # pacman -Syu "bind>=9.10.1.P1-1" The problem has been fixed upstream in version 9.10.1.P1. Workaround ========== None. Description =========== By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation. This can lead to resource exhaustion and denial of service (up to and including termination of the named server process). Impact ====== A remote attacker is able to make use of maliciously-constructed zones or a rogue server that can lead to resource exhaustion and denial of service. References ========== https://kb.isc.org/article/AA-01216/0 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-6] mantisbt: multiple issues
by Levente Polyak 08 Dec '14

08 Dec '14

Arch Linux Security Advisory ASA-201412-6 ========================================= Severity: Critical Date : 2014-12-08 CVE-ID : CVE-2014-9272 CVE-2014-9270 CVE-2014-8987 CVE-2014-9271 CVE-2014-9281 CVE-2014-8986 CVE-2014-9269 CVE-2014-9280 CVE-2014-9089 CVE-2014-9279 CVE-2014-8988 CVE-2014-8553 CVE-2014-6387 CVE-2014-6316 CVE-2014-9117 Package : mantisbt Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mantisbt before version 1.2.18-1 is suffering from multiple issues including but not limited to code execution, sql injection, authentication bypass, cross-site scripting and information disclosure. Resolution ========== Upgrade to 1.2.18-1. # pacman -Syu "mantisbt>=1.2.18-1" The problems have been fixed upstream in version 1.2.18. Workaround ========== None. Description =========== - CVE-2014-9272 (cross-side scripting) The function "string_insert_hrefs" doesn't validate the protocol, which is why one can make a link that executes arbitrary JavaScript code. - CVE-2014-9270 (cross-side scripting) The Projax library does not properly escape html strings. An attacker could take advantage of this to perform an XSS attack using the profile/Platform field. - CVE-2014-8987 (cross-side scripting) The MantisBT Configuration Report page (adm_config_report.php) did not escape a parameter before displaying it on the page, allowing an attacker to execute arbitrary JavaScript code. - CVE-2014-9271 (cross-side scripting) It's possible to upload Flash files and make open them inline by using an image extension. Since Flash files can execute JavaScript this becomes a persistent XSS. - CVE-2014-9281 (cross-side scripting) A missing sanity check in copy_field.php is leading to a reflected XSS vulnerability which could be exploited f.e. by the dest_id parameter. - CVE-2014-8986 (cross-side scripting) Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) allows remote administrators to inject arbitrary web script or HTML via a crafted config option. - CVE-2014-9269 (cross-side scripting) Extended project browser allows projects to be passed in as A;B. helper_get_current_project() and helper_get_current_project_trace() then explodes the string by ';' and doesn't check that A is an int (representing a project/sub-project id). Finally, print_extended_project_browser() prints the result of the split into a JavaScript array. - CVE-2014-9280 (code execution) PHP Object Injection in filter API in the function current_user_get_bug_filter (core\current_user_api.php line 212). The code loads a variable from $_GET['filter']/$_POST['filter'] and if it's not numeric, feeds it straight into unserialize() on line 223. The current_user_get_bug_filter function is called in 10 places, easiest is just to access /view_filters_page.php. A PoC initializing a class that's loaded could look like this: /view_filters_page.php?filter=O:16:"MantisPHPSession":2:{s:2:"id";s:1:"1";s:3:"key";s:3:"wee";} - CVE-2014-9089 (sql injection) Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the 'sort' or 'dir' parameter to view_all_set.php. Both parameters are split into chunks on ','. After splitting, only the first two values are validated. By supplying a third value, SQL injection can be performed. - CVE-2014-9279 (information disclosure) Database credentials leak via unattended upgrade script will connect to arbitrary host with the current DB config credentials. The unattended upgrade script retrieved DB connection settings from POST parameters, allowing an attacker to get the script to connect to their host with the current DB config credentials. - CVE-2014-8988 (information disclosure) It is possible to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL. - CVE-2014-8553 (information disclosure) No public information is available yet. - CVE-2014-6387 (authentication bypass) A flaw in gpc_api.php allows remote attackers to bypass authentication via a password starting will a null byte, which triggers an unauthenticated bind. A malicious user can exploit this vulnerability to login as any registered user and without knowing their password, to systems relying on LDAP for user authentication (e.g. Active Directory or OpenLDAP with "allow bind_anon_cred"). - CVE-2014-6316 (cross-site redirection) When Mantis is installed at the web server's root, $g_short_path is set to '/'. string_sanitize_url() removes the trailing '/' from the short path, which causes the URL to be incorrectly categorized as "type 2", thus allowing cross-site redirection to occur. - CVE-2014-9117 (captcha bypass) MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a public_key parameter value, as demonstrated by E4652 for the public_key value 0. Impact ====== A remote attacker is able to bypass the authentication, execute arbitrary code, perform sql injection, steal sessions via cross-site scripting or disclosure sensitive information. References ========== https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 http://seclists.org/oss-sec/2014/q4/955 https://access.redhat.com/security/cve/CVE-2014-9272 https://www.mantisbt.org/bugs/view.php?id=17297 https://access.redhat.com/security/cve/CVE-2014-9270 https://www.mantisbt.org/bugs/view.php?id=17583 https://access.redhat.com/security/cve/CVE-2014-8987 https://www.mantisbt.org/bugs/view.php?id=17870 https://access.redhat.com/security/cve/CVE-2014-9271 https://www.mantisbt.org/bugs/view.php?id=17874 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9281 https://www.mantisbt.org/bugs/view.php?id=17876 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8986 https://www.mantisbt.org/bugs/view.php?id=17889 https://access.redhat.com/security/cve/CVE-2014-9269 https://www.mantisbt.org/bugs/view.php?id=17890 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9280 https://www.mantisbt.org/bugs/view.php?id=17875 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9089 https://www.mantisbt.org/bugs/view.php?id=17841 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9279 https://www.mantisbt.org/bugs/view.php?id=17877 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8988 https://www.mantisbt.org/bugs/view.php?id=17742 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8553 https://www.mantisbt.org/bugs/view.php?id=17243 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6387 https://www.mantisbt.org/bugs/view.php?id=17640 https://access.redhat.com/security/cve/CVE-2014-6316 https://www.mantisbt.org/bugs/view.php?id=17648 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9117 https://www.mantisbt.org/bugs/view.php?id=17811

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-5] antiword: buffer overflow
by Levente Polyak 04 Dec '14

04 Dec '14

Arch Linux Security Advisory ASA-201412-5 ========================================= Severity: High Date : 2014-12-04 CVE-ID : CVE-2014-8123 Package : antiword Type : buffer overflow Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package antiword before version 0.37-5 is suffering from a buffer overflow vulnerability that may lead to arbitrary code execution. Resolution ========== Upgrade to 0.37-5. # pacman -Syu "antiword>=0.37-5" The problem has not yet been fixed upstream but a local patch is applied. Workaround ========== None. Description =========== The program antiword is suffering from a buffer overflow within atPPSlist[].szName[] that may lead to denial of service or arbitrary code execution. Impact ====== An attacker is able to craft a special file hat triggers the buffer overflow leading to denial of service or arbitrary code execution. References ========== http://seclists.org/oss-sec/2014/q4/874 https://access.redhat.com/security/cve/CVE-2014-8123 https://bugs.archlinux.org/task/42982

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-4] graphviz: format string vulnerability
by Remi Gacogne 03 Dec '14

03 Dec '14

Arch Linux Security Advisory ASA-201412-4 ========================================= Severity: Medium Date : 2014-12-03 CVE-ID : CVE-2014-9157 Package : graphviz Type : format string vulnerability Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package graphviz before version 2.38.0-3 is vulnerable to a format string vulnerability. Resolution ========== Upgrade to 2.38.0-3. # pacman -Syu "graphviz>=2.38.0-3" The problem has been fixed upstream, but there has been no release including the fix yet. Workaround ========== None. Description =========== A format string vulnerability has been found in the error reporting part of the parser used by graphviz. Impact ====== An attacker might be able to execute arbitrary code by supplying a specially crafted file to graphviz. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9157 http://seclists.org/oss-sec/2014/q4/872 https://bugs.archlinux.org/task/42983 https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe4…

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-3] firefox: multiple issues
by Remi Gacogne 03 Dec '14

03 Dec '14

Arch Linux Security Advisory ASA-201412-3 ========================================= Severity: Critical Date : 2014-12-03 CVE-ID : CVE-2014-1587 CVE-2014-1588 CVE-2014-1589 CVE-2014-1590 CVE-2014-1591 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-8631 CVE-2014-8632 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package firefox before version 34.0.5-1 is vulnerable to multiple issues, including denial of service, information leak and remote code execution. Resolution ========== Upgrade to 34.0.5-1. # pacman -Syu "firefox>=34.0.5-1" The problem has been fixed upstream in version 34.0.5. Workaround ========== None. Description =========== CVE-2014-1587: Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, and Max Jonas Werner reported memory safety problems and crashes that affect Firefox ESR 31.2 and Firefox 33. CVE-2014-1588: Christian Holler, Gary Kwong, Jon Coppeard, Eric Rahm, Byron Campen, Eric Rescorla, and Xidorn Quan reported memory safety problems and crashes that affect Firefox 33. CVE-2014-1589: Security researcher Cody Crews reported a method to trigger chrome level XML Binding Language (XBL) bindings through web content. This was possible because some chrome accessible CSS stylesheets had their primary namespace improperly declared. When this occurred, it was possible to use these stylesheets to manipulate XBL bindings, allowing web content to bypass security restrictions. This issue was limited to a specific set of stylesheets. CVE-2014-1590: Security researcher Joe Vennix from Rapid7 reported that passing a JavaScript object to XMLHttpRequest that mimics an input stream will a crash. This crash is not exploitable and can only be used for denial of service attacks. CVE-2014-1591: Security researcher Muneaki Nishimura discovered that Content Security Policy (CSP) violation reports triggered by a redirect did not remove path information as required by the CSP specification. This potentially reveals information about the redirect that would not otherwise be known to the original site. This could be used by a malicious site to obtain sensitive information such as usernames or single-sign-on tokens encoded within the target URLs. CVE-2014-1592: Security researcher Berend-Jan Wever reported a use-after-free created by triggering the creation of a second root element while parsing HTML written to a document created with document.open(). This leads to a potentially exploitable crash. CVE-2014-1593: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a buffer overflow during the parsing of media content. This leads to a potentially exploitable crash. CVE-2014-1594: Security researchers Byoungyoung Lee, Chengyu Song, and Taesoo Kim at the Georgia Tech Information Security Center (GTISC) reported a bad casting from the BasicThebesLayer to BasicContainerLayer, resulting in undefined behavior. This behavior is potentially exploitable with some compilers but no clear mechanism to trigger it through web content was identified. CVE-2014-8631: CVE-2014-8632: Privileged access to security wrapped protected objects. Both of these issues could allow web content to access DOM objects that are intended to be chrome-only. Impact ====== A remote attacker, controlling a malicious website or in position of man-in-the-middle might be able to steal sensitive information, crash the firefox browser or execute arbitrary code. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1588 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1589 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1590 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1591 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1592 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1593 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1594 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8631 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8632 https://www.mozilla.org/fr/security/known-vulnerabilities/firefox/

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-2] openvpn: denial of service
by Levente Polyak 02 Dec '14

02 Dec '14

Arch Linux Security Advisory ASA-201412-2 ========================================= Severity: High Date : 2014-12-02 CVE-ID : CVE-2014-8104 Package : openvpn Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package openvpn before version 2.3.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.3.6-1. # pacman -Syu "openvpn>=2.3.6-1" The problem has been fixed upstream [0] in version 2.3.6. Workaround ========== None. Description =========== It was discovered that an authenticated client could trigger an ASSERT() in OpenVPN by sending a too-short control channel packet to the server. This could cause the OpenVPN server to crash and deny access to the VPN to other legitimate users. Impact ====== A remote authenticated attacker could send specially crafted packets that could cause the OpenVPN server to crash leading to denial of service of other legitimate users. References ========== [0] https://github.com/OpenVPN/openvpn/commit/c5590a https://access.redhat.com/security/cve/CVE-2014-8104 https://forums.openvpn.net/topic17625.html https://bugs.archlinux.org/task/42975

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-1] gnupg: denial of service
by Remi Gacogne 01 Dec '14

01 Dec '14

Arch Linux Security Advisory ASA-201412-1 ========================================= Severity: Medium Date : 2014-12-01 CVE-ID : CVE-2014-9087 Package : gnupg Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package gnupg before version 2.1.0-6 is vulnerable to the same denial of service issue than the one in libska (ASA-201411-31), as they share the same code. Resolution ========== Upgrade to 2.1.0-6. # pacman -Syu "gnupg>=2.1.0-6" The problem has been fixed upstream but no new version has been released yet for the 2.1.x branch. Workaround ========== None. Description =========== By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow. The bug is not easy to exploit because there only 80 possible values which can be used to overwrite memory. However, a denial of service is possible and someone may come up with other clever attacks. Thus this should be fix. Background: Hanno Böck found an invalid memory access in the 2.1 branch of GnuPG by conveying a malformed OID as part of an ECC key. It turned out that this bug has also been in libksba ever since and affects at least gpgsm and dirmngr. The code to convert an OID to its string representation has an obvious error of not considering an invalid encoding for arc-2. A first byte of 0x80 can be used to make a value of less then 80 and we then subtract 80 from it as required by the OID encoding rules. Due to the use of an unsigned integer this results in a pretty long value which won't fit anymore into the allocated buffer. Impact ====== A remote attacker can cause a denial of service by sending a specially crafted S/MIME message or ECC based OpenPGP data. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9087 http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html http://seclists.org/oss-sec/2014/q4/801 https://bugs.archlinux.org/task/42943

1 0