April 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201504-32] perl-xml-libxml: XML External Entity
by Christian Rebischke 30 Apr '15

30 Apr '15

Arch Linux Security Advisory ASA-201504-32 ========================================= Severity: low Date : 2015-04-30 CVE-ID : CVE-2015-3451 Package : perl-xml-libxml Type : XML External Entity Remote : yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package perl-xml-libxml before version 2.0119-1 is vulnerable to a XML-External-Entity-Vulnerability. Resolution ========== Upgrade to 2.0119-1 # pacman -Syu "perl-xml-libxml>=2.0119-1" The problem has been fixed upstream in version 2.0119. Workaround ========== None. Description =========== Unpreserved unset options after a _clone() call (e.g: in load_xml()) leads to not preserved expand_entities. Therefore it leads to a XML-External-Entity Vulnerability. Impact ====== This vulnerability may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts. References ========== http://www.openwall.com/lists/oss-security/2015/04/30/1 https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94… http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes

1 0

[arch-security] [ASA-201504-31] dovecot: denial of service
by Remi Gacogne 29 Apr '15

29 Apr '15

Arch Linux Security Advisory ASA-201504-31 ========================================== Severity: Low Date : 2015-04-29 CVE-ID : CVE-2015-3420 Package : dovecot Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package dovecot before version 2.2.16-2 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 2.2.16-2. # pacman -Syu "dovecot>=2.2.16-2" The problem has been fixed upstream but no new version has been released yet. Workaround ========== None. Description =========== Dovecot <= 2.2.14 does not correctly handle SSL/TLS handshake failure in the login process, asking OpenSSL to flush a connection that has already been aborted. This results in a crash with some versions of OpenSSL (most likely >= 1.0.2). A patch to OpenSSL has also been written to handle more gracefully this situation, see references. Impact ====== A remote unauthenticated attacker can cause a denial of service by constantly connecting to Dovecot then causing a SSL/TLS handshake failure. References ========== https://access.redhat.com/security/cve/CVE-2015-3420 https://bugs.archlinux.org/task/44757 http://seclists.org/oss-sec/2015/q2/288 http://dovecot.org/pipermail/dovecot/2015-April/100618.html https://rt.openssl.org/Ticket/Display.html?id=3818&user=guest&pass=guest

1 0

[arch-security] [ASA-201504-30] chromium: multiple issues
by Remi Gacogne 29 Apr '15

29 Apr '15

Arch Linux Security Advisory ASA-201504-30 ========================================== Severity: High Date : 2015-04-29 CVE-ID : CVE-2015-1243 CVE-2015-1250 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 42.0.2311.135-1 is vulnerable to multiple issues, including but not limited to a use-after-free. Resolution ========== Upgrade to 42.0.2311.135-1. # pacman -Syu "chromium>=42.0.2311.135-1" The problem has been fixed upstream in version 42.0.2311.135. Workaround ========== None. Description =========== - CVE-2015-1243 (use-after-free): Use-after-free in DOM. Credit to Saif El-Sherei. - CVE-2015-1250: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== Google has not disclosed any information regarding the issues fixed in this release. Four of them (CVE-2015-1243 and three more covered by CVE-2015-1250) are classified as "high", while the remaining issue covered by CVE-2015-125 is classified as medium. References ========== http://googlechromereleases.blogspot.fr/2015/04/stable-channel-update_28.ht… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1243 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1250

1 0

[arch-security] [ASA-201504-29] wpa_supplicant: arbitrary code execution
by Remi Gacogne 24 Apr '15

24 Apr '15

Arch Linux Security Advisory ASA-201504-29 ========================================== Severity: Critical Date : 2015-04-24 CVE-ID : CVE-2015-1863 Package : wpa_supplicant Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wpa_supplicant before version 2.4-1 is vulnerable to denial of service, leak of sensitive information and potentially arbitrary code execution. Resolution ========== Upgrade to 2.4-1. # pacman -Syu "wpa_supplicant>=2.4-1" The problem has been fixed upstream but an updated version has not been released yet. Workaround ========== This issue can be mitigated by disabling the P2P feature support in the /etc/wpa_supplicant/wpa_supplicant.conf configuration file. Either "P2P_SET disabled 1" or "p2p_disabled=1" should be set for each interface used. Description =========== A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from a peer device. This can result in copying arbitrary data from an attacker to a fixed length buffer of 32 bytes (i.e., a possible overflow of up to 223 bytes). The SSID buffer is within struct p2p_device that is allocated from heap. The overflow can override couple of variables in the struct, including a pointer that gets freed. In addition about 150 bytes (the exact length depending on architecture) can be written beyond the end of the heap allocation. This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to wpa_supplicant process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution. Attacker (or a system controlled by the attacker) needs to be within radio range of the vulnerable system to send a suitably constructed management frame that triggers a P2P peer device information to be created or updated. The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress). However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress. Impact ====== A remote attacker within radio range may be able to cause a denial of service, read arbitrary memory or execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2015-1863 http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt https://bugs.archlinux.org/task/44695

1 0

[arch-security] [ASA-201504-28] curl: multiple issues
by Remi Gacogne 24 Apr '15

24 Apr '15

Arch Linux Security Advisory ASA-201504-28 ========================================== Severity: Medium Date : 2015-04-24 CVE-ID : CVE-2015-3143 CVE-2015-3144 CVE-2015-3145 CVE-2015-3148 Package : curl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.42.0-1 is vulnerable to multiple issues, including but not limited to denial of service and authentication bypass for NTLM/Negotiate HTTP authentication. Resolution ========== Upgrade to 7.42.0-1. # pacman -Syu "curl>=7.42.0-1" The problem has been fixed upstream in version 7.42.0. Workaround ========== None. Description =========== - CVE-2015-3143 (re-using authenticated connection when unauthenticated): libcurl keeps a pool of its last few connections around after use to fascilitate easy, conventient and completely transparent connection re-use for applications. When doing HTTP requests NTLM authenticated, the entire connnection becomes authenticated and not just the specific HTTP request which is otherwise how HTTP works. This makes NTLM special and a subject for special treatment in the code. With NTLM, once the connection is authenticated, no further authentication is necessary until the connection gets closed. libcurl's connection re-use logic will select an existing connection for re-use when asked to do a request, and when asked to use NTLM libcurl have to pick a connection with matching credentials only. If a connection was first setup and used for an NTLM HTTP request with a specific set of credentials, that same connection could later wrongly get re-used in a subsequent HTTP request that was made to the same host - but without having any credentials set! Since an NTLM connection was already authenticated due to how NTLM works, the subsequent request could then get sent over the wrong connection appearing as the initial user. This problem is very similar to the previous problem known as CVE-2014-0015. The main difference this time is that the subsequent request that wrongly re-use a connection doesn't ask for NTLM authentication. - CVE-2015-3144 (host name out of boundary memory access): There is a private function in libcurl called fix_hostname() that removes a trailing dot from the host name if there is one. The function is called after the host name has been extracted from the URL libcurl has been told to act on. If a URL is given with a zero-length host name, like in "http://:80" or just ":80", fix_hostname() will index the host name pointer with a -1 offset (as it blindly assumes a non-zero length) and both read and assign that address. At best, this gets unnoticed but can also lead to a crash or worse. We have not researched further what kind of malicious actions that potentially this could be used for. - CVE-2015-3145 (cookie parser out of boundary memory access): libcurl supports HTTP "cookies" as documented in RFC 6265. Together with each individual cookie there are several different properties, but for this vulnerability we focus on the associated "path" element. It tells information about for which path on a given host the cookies is valid. The internal libcurl function called sanitize_cookie_path() that cleans up the path element as given to it from a remote site or when read from a file, did not properly validate the input. If given a path that consisted of a single double-quote, libcurl would index a newly allocated memory area with index -1 and assign a zero to it, thus destroying heap memory it wasn't supposed to. At best, this gets unnoticed but can also lead to a crash or worse. We have not researched further what kind of malicious actions that potentially this could be used for. Applications have to explicitly enable cookie parsing in libcurl for this problem to trigger, and if not enabled libcurl will not hit this problem. - CVE-2015-3148 (negotiate not treated as connection-oriented): libcurl keeps a pool of its last few connections around after use to fascilitate easy, conventient and completely transparent connection re-use for applications. When doing HTTP requests Negotiate authenticated, the entire connnection may become authenticated and not just the specific HTTP request which is otherwise how HTTP works, as Negotiate can basically use NTLM under the hood. curl was not adhering to this fact but would assume that such requests would also be authenticated per request. The net effect is that libcurl may end up re-using an authenticated Negotiate connection and sending subsequent requests on it using new credentials, while the connection remains authenticated with a previous initial credentials setup. Impact ====== An attacker controlling the URL supplied to libcurl can cause a denial of service or other unspecified impact. A remote attacker controlling a malicious server, or an active attacker in position of man-in-the-middle, may be able to cause a denial of service or other unspecified impact if cookie parsing has been enabled. An attacker may be able to bypass authentication by tricking libcurl into reusing an already authenticated HTTP connection using NTLM or Negotiate authentication. References ========== https://access.redhat.com/security/cve/CVE-2015-3143 https://access.redhat.com/security/cve/CVE-2015-3144 https://access.redhat.com/security/cve/CVE-2015-3145 https://access.redhat.com/security/cve/CVE-2015-3148 http://curl.haxx.se/docs/adv_20150422A.html http://curl.haxx.se/docs/adv_20150422B.html http://curl.haxx.se/docs/adv_20150422C.html http://curl.haxx.se/docs/adv_20150422D.html

1 0

[arch-security] [ASA-201504-27] powerdns-recursor: denial of service
by Levente Polyak 24 Apr '15

24 Apr '15

Arch Linux Security Advisory ASA-201504-27 ========================================== Severity: Low Date : 2015-04-24 CVE-ID : CVE-2015-1868 Package : powerdns-recursor Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package powerdns-recursor before version 3.7.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.7.2-1. # pacman -Syu "powerdns-recursor>=3.7.2-1" The problem has been fixed upstream in version 3.7.2. Workaround ========== Exposure can be limited by configuring the allow-from setting so only trusted users can query your nameserver. Description =========== A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. This loop is capped at a 1000 iterations by a failsafe, making the issue harmless on most platforms. However, on specific platforms, the recursion involved in these 1000 steps causes memory corruption leading to a quick crash, presumably because the default stack is too small. Impact ====== A remote attacker is able to send queries for specifically configured domains to trigger a flaw that may possibly lead to denial of service. References ========== https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/ https://access.redhat.com/security/cve/CVE-2015-1868 https://bugs.archlinux.org/task/44708

1 0

[arch-security] [ASA-201504-26] powerdns: denial of service
by Levente Polyak 24 Apr '15

24 Apr '15

Arch Linux Security Advisory ASA-201504-26 ========================================== Severity: Low Date : 2015-04-24 CVE-ID : CVE-2015-1868 Package : powerdns Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package powerdns before version 3.4.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.4.4-1. # pacman -Syu "powerdns>=3.4.4-1" The problem has been fixed upstream in version 3.4.4. Workaround ========== Exposure can be limited by configuring the allow-from setting so only trusted users can query your nameserver. Description =========== A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. This loop is capped at a 1000 iterations by a failsafe, making the issue harmless on most platforms. However, on specific platforms, the recursion involved in these 1000 steps causes memory corruption leading to a quick crash, presumably because the default stack is too small. Impact ====== A remote attacker is able to send queries for specifically configured domains to trigger a flaw that may possibly lead to denial of service. References ========== https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/ https://access.redhat.com/security/cve/CVE-2015-1868 https://bugs.archlinux.org/task/44708

1 0

[arch-security] wpa_supplicant: Potential Remote Code Execution
by Jonathan Roemer 23 Apr '15

23 Apr '15

CVE-2015-1863 Published April 22, 2015 Relevant bug report https://bugs.archlinux.org/task/44695 Source http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt Vulnerability A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from a peer device. This can result in copying arbitrary data from an attacker to a fixed length buffer of 32 bytes (i.e., a possible overflow of up to 223 bytes). The SSID buffer is within struct p2p_device that is allocated from heap. The overflow can override couple of variables in the struct, including a pointer that gets freed. In addition about 150 bytes (the exact length depending on architecture) can be written beyond the end of the heap allocation. This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to wpa_supplicant process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution. Vulnerable versions/configurations wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled Attacker (or a system controlled by the attacker) needs to be within radio range of the vulnerable system to send a suitably constructed management frame that triggers a P2P peer device information to be created or updated. The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress). However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress. Acknowledgments Thanks to Google security team for reporting this issue and smart hardware research group of Alibaba security team for discovering it. Possible mitigation steps - Merge the following commits to wpa_supplicant and rebuild it: P2P: Validate SSID element length before copying it (CVE-2015-1863) This patch is available from http://w1.fi/security/2015-1/ - Update to wpa_supplicant v2.5 or newer, once available - Disable P2P (control interface command "P2P_SET disabled 1" or "p2p_disabled=1" in (each, if multiple interfaces used) wpa_supplicant configuration file) - Disable P2P from the build (remove CONFIG_P2P=y)

1 0

[arch-security] [ASA-201504-25] glibc: arbitrary code execution
by Remi Gacogne 23 Apr '15

23 Apr '15

Arch Linux Security Advisory ASA-201504-25 ========================================== Severity: High Date : 2015-04-23 CVE-ID : CVE-2015-1781 Package : glibc Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.21-3 is vulnerable to a buffer overflow resulting in arbitrary code execution. Resolution ========== Upgrade to 2.21-3. # pacman -Syu "glibc>=2.21-3" The problem has been fixed upstream but a new version has yet to be released. Workaround ========== None. Description =========== A buffer overflow in gethostbyname_r() and related functions performing DNS requests has been fixed. If the NSS functions were called with a misaligned buffer, the buffer length change due to pointer alignment was not taken into account. This could result in application crashes or potentially arbitrary code execution using crafted but syntactically valid DNS responses. Impact ====== A remote attacker can crash or execute arbitrary code by crafting malicious DNS responses to the requests made by an application. To be vulnerable, the application must be passing a misaligned buffer to gethostbyname_r() or related functions. References ========== https://access.redhat.com/security/cve/CVE-2015-1781 http://www.openwall.com/lists/oss-security/2015/04/21/4 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=2959eda9272a033863c2…

1 0

[arch-security] [ASA-201504-24] firefox: arbitrary code execution
by Levente Polyak 22 Apr '15

22 Apr '15

Arch Linux Security Advisory ASA-201504-24 ========================================== Severity: Critical Date : 2015-04-22 CVE-ID : CVE-2015-2706 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 37.0.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 37.0.2-1. # pacman -Syu "firefox>=37.0.2-1" The problem has been fixed upstream in version 37.0.2. Workaround ========== None. Description =========== Mozilla developer Robert Kaiser reported that a specially crafted HTML, when loaded by the target user, will trigger a use-after-free race condition when a plugin fails to initialize, which may lead to a memory corruption error in AsyncPaintWaitEvent::AsyncPaintWaitEvent() and arbitrary code execution on the target system. Impact ====== A remote attacker is able to use a specially crafted HTML that, when loaded by the target user, will trigger a race condition leading to memory corruption and arbitrary code execution. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/ https://access.redhat.com/security/cve/CVE-2015-2706

1 0