March 2014 - Arch-security - lists.archlinux.org

[arch-security] [kernel] CVE-2014-2568 net: potential information leak when ubuf backed skbs are skb_zerocopy()ied
by Billy McCann 21 Mar '14

21 Mar '14

[linux] CVE-2014-2568 net: potential information leak when ubuf backed skbs are skb_zerocopy()ied Description " An information leak flaw was found in the way skb_zerocopy() copied skbs that are backed by userspace buffers (for example vhost-net and recent xen netback). Once the source skb is consumed, ubuf destructor is called and potentially releases the corresponding userspace buffers, which can then for example be repurposed, while the destination skb is still pointing to the them. " MITRE assignment http://seclists.org/oss-sec/2014/q1/630 Upstream Patch https://lkml.org/lkml/2014/3/20/421 Bug Report https://bugs.archlinux.org/task/39566 Patch attached to bug report

1 0

[arch-security] [python] CVE-2013-7338 ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips
by Billy McCann 19 Mar '14

19 Mar '14

Greetings. CVE-2013-7338 has been assigned to python issue 20078. "zipfile - ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips ". [0] This issue is not resolved in Python 3.4.0[1]. An upstream fix is available. [2] FS39540 has been filed with "Resolution=patch". [3] [0] http://bugs.python.org/issue20078 [1] http://docs.python.org/3.4/whatsnew/3.4.html [2] http://hg.python.org/cpython/rev/79ea4ce431b1 [3] https://bugs.archlinux.org/task/39540 BW

1 1

[arch-security] [nginx] CVE-2014-0133: SPDY heap buffer overflow
by Lance Chen 19 Mar '14

19 Mar '14

Hello, CVE-2014-0133 was announced for Nginx between version 1.3.15 and 1.5.11. Solution: Upgrade [community] nginx to 1.4.7. Summary (fetched from nginx change log): CVE-2014-0133 A heap memory buffer overflow might occur in a worker process while handling a specially crafted request by ngx_http_spdy_module, potentially resulting in arbitrary code execution. Links: http://nginx.org/en/CHANGES-1.4 http://nginx.org/en/security_advisories.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 Lance Chen

2 3

[arch-security] [kernel] CVE-2014-2523 (fixed??) - netfilter: nf_conntrack_dccp: incorrect skb_header_pointer API usages :: FIXED??
by Billy McCann 18 Mar '14

18 Mar '14

Greetings all. CVE-2014-2523 for linux kernel has been assigned. However, I'm having difficulty finding whether this issue is fixed in the current (Arch) kernel. I'm thinking it has been, as the fixing commit was made on 06/01/2014. Confirmation requested. *Relevant info CVE details: https://access.redhat.com/security/cve/CVE-2014-2523 Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2… Upstream Fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b… BW

2 1

Re: [arch-security] Division of Labor
by RbN 17 Mar '14

17 Mar '14

> I also think we need a system to track which CVEs have been dealt with. > > How about a wiki page with a table (per month?) with the following columns: > > CVE Id > Package/version > Date public > Update/Bug (upstream version with fix or bug report number with patch) > Fixed version > Time vulnerable (for interest!) > > Allan I just created a page to track CVE for 2014 (if it gets too long, we will split it later) : https://wiki.archlinux.org/index.php/CVE-2014 It's basically a table wth the following columns for each CVE : CVE-id Package/version Date public Update/Bug (upstream version with fix or bug report number with patch) Fixed version Time vulnerable (for interest!) As you might see, any wikitext ninja is welcome to improve the table ;) I will add some links later : CVE -ids linked to Mitre Package name linked to the good page FS# linked to the bug report I filled it with the content of the file I used on my laptop to keep track of CVE to see how it looks like with real content. There is CVE with the time vulnerable field filled with "??", it means that I didn't take time to check it, it's easy work for anybody willing to gets his hands dirty with CVE management. RbN

2 2

[arch-security] gnu-coreutils patched : possible future CVE announcement
by Billy McCann 14 Mar '14

14 Mar '14

Greetings all. There has been a CVE request for gnu coreutils 8.22. This request may be found on the openwall mailing list. The CVE request is concerned with `shuf'. The bug report can be viewed here https://bugs.archlinux.org/task/39425 The patch has been applied and marked FIXED. Should a CVE for gnu coreutils 8.22 centered on `shuf' be released, this issue has already been resolved within Arch Linux. Regards, BW

1 0

[arch-security] CVE-2013-4496 | CVE-2013-6442 [samba]
by Billy McCann 14 Mar '14

14 Mar '14

Samba has been flagged out-of-date since 2014-03-12. Two CVE's were issued 2014-03-14. *Solution* Upgrade [extra] samba to 4.1.6. *Summary* CVE-2013-4496: Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts. CVE-2013-6442 Samba versions 4.0.0 and above have a flaw in the smbcacls command. If smbcacls is used with the "-C|--chown name" or "-G|--chgrp name" command options it will remove the existing ACL on the object being modified, leaving the file or directory unprotected. *Links* http://www.samba.org/samba/security/CVE-2013-4496 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4496 http://www.samba.org/samba/security/CVE-2013-6442 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6442 ------------------------------------------[00(01|10)11] ----------------------------------------- Billy Wayne McCann, Ph.D. Google+ <https://plus.google.com/+BillyWayneMcCann> PGP Key <http://pgp.mit.edu/pks/lookup?op=get&search=0x223A2CAA56146040> irc://irc.freenode.net:bwayne MzM0LTcwMy0wMTIyCg== | base64 -d "A rich man will always desire what his wealth cannot acquire." ~ Faust (Goethe) ------------------------------------------[11(10|01)00]------- -----------------------------------

1 2

[arch-security] [flash-plugin] CVE-2014-0504 : attackers read the clipboard via unspecified vectors
by Billy McCann 13 Mar '14

13 Mar '14

A CVE was announced for Adobe Flash Player on 3-12 . flash-plugin has been flagged out of date since 3-11. https://www.archlinux.org/packages/extra/i686/flashplugin/ Bug has been filed to alert devs that upgrad e is critical. See issue entry below. https://bugs.archlinux.org/task/39385 BW === B E G I N B U G R E P O R T ======= Description: Adobe Flash Player before 11.2.202.346 on Linux allows attackers to read the clipboard via unspecified vectors. Solution: Update to latest Flash Player. Links to Description: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0504 http://helpx.adobe.com/security/products/flash-player/apsb14-08.html Additional info: * package version(s) 11.2.202.341 * Misc Package was flagged as outdated on the 11th of March, 2014. https://www.archlinux.org/packages/extra/i686/flashplugin/ === E N D ===== ------------------------------------------[00(01|10)11]----------------------------------------- Billy Wayne McCann, Ph.D. Google+ PGP Key irc://irc.freenode.net:bwayne MzM0LTcwMy0wMTIyCg== | base64 -d "A rich man will always desire what his wealth cannot acquire." ~ Faust (Goethe) ------------------------------------------[11(10|01)00]------------------------------------------

1 1

[arch-security] Security-related ressources
by RbN 12 Mar '14

12 Mar '14

Hello, A message to give some hints and links to look more efficiently for security issues and CVE. Some mailing lists : * oss-sec main list dealing with security of free software, a lot of CVE attributions happen here, required if you wish to follow security news. * info: http://oss-security.openwall.org/wiki/mailing-lists/oss-security * subscribe: oss-security-subscribe(at)lists.openwall.com * archive: http://www.openwall.com/lists/oss-security/ * bugtraq a full disclosure moderated mailing list (noisy) * info: http://www.securityfocus.com/archive/1/description * subscribe: bugtraq-subscribe(at)securityfocus.com * full-disclosure another full-disclosure mailing-list (noisy) * info: http://lists.grok.org.uk/full-disclosure-charter.html * subscribe: full-disclosure-request(at)lists.grok.org.uk You can also use some others : LibreOffice, X.org, Puppetlabs, ISC, etc. Resources of other distributions (to look for CVE, patch, comments etc.): *RedHat and Fedora: * rss advisories: https://admin.fedoraproject.org/updates/rss/rss2.0?type=security * CVE tracker: https://access.redhat.com/security/cve/<CVE-id> * bug tracker: https://bugzilla.redhat.com/show_bug.cgi?id=<CVE-id> Ubuntu: * advisories: http://www.ubuntu.com/usn/atom.xml * CVE tracker: http://people.canonical.com/~ubuntu-security/cve/?cve=<CVE-id> * database: https://code.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/master Debian: * CVE tracker: http://security-tracker.debian.org/tracker/<CVE-id> * patch-tracker: http://patch-tracker.debian.org/ * database: http://anonscm.debian.org/viewvc/secure-testing/data/ OpenSUSE: * CVE tracker: http://support.novell.com/security/cve/<CVE-id>.html Mitre and NVD links for CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=<CVE-id> http://web.nvd.nist.gov/view/vuln/detail?vulnId=<CVE-id> NVD and Mitre do not necessarily fill their CVE entry immediately after attribution, so it's not always relevant for us. The CVE-id and the "Date Entry Created" fields do not have particular meaning. CVE are attributed by CVE Numbering Authorities (CNA), and each CNA obtain CVE blocks from Mitre when needed/asked, so the CVE ID is not linked to the attribution date. The "Date Entry Created" field often only indicates when the CVE block was given to the CNA, nothing more. Linux Weekly News: LWN provides a daily notice of security updates for various distributions, sometimes very usefull: http://lwn.net/headlines/newrss This might be very handy to check if we miss something. If you need more, check the openwall wiki: http://oss-security.openwall.org/wiki/ RbN

2 1

[arch-security] Wiki Page
by Billy McCann 12 Mar '14

12 Mar '14

Greetings All. A rough draft for the wiki page describing the "Arch CVE Monitoring Team" as well as project categories and a "sign-up sheet" of sorts has been published. https://wiki.archlinux.org/index.php/Arch_CVE_Monitoring_Team I ask those interested to read, correct mistakes, add to, or subtract from this article. Best wishes, BW ------------------------------------------[00(01|10)11] ----------------------------------------- Billy Wayne McCann, Ph.D. Google+ <https://plus.google.com/+BillyWayneMcCann> PGP Key <http://pgp.mit.edu/pks/lookup?op=get&search=0x223A2CAA56146040> irc://irc.freenode.net:bwayne MzM0LTcwMy0wMTIyCg== | base64 -d "A rich man will always desire what his wealth cannot acquire." ~ Faust (Goethe) ------------------------------------------[11(10|01)00]------- -----------------------------------

1 0