April 2015 - Arch-security - lists.archlinux.org

[arch-security] flashplugin: multiple issues
by Manuel Reimer 17 Apr '15

17 Apr '15

Hello, I don't understand why this one is not addressed, so far. The package already is flagged as "out of date".... https://helpx.adobe.com/security/products/flash-player/apsb15-06.html Greetings, Manuel

2 1

[arch-security] [ASA-201504-14] php: multiple issues
by Levente Polyak 17 Apr '15

17 Apr '15

Arch Linux Security Advisory ASA-201504-14 ========================================== Severity: High Date : 2015-04-17 CVE-ID : CVE-2015-1351 CVE-2015-1352 CVE-2015-2783 Package : php Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package php before version 5.6.8-1 is vulnerable to denial of service and information disclosure. Resolution ========== Upgrade to 5.6.8-1. # pacman -Syu "php>=5.6.8-1" The problems have been fixed upstream in version 5.6.8. Workaround ========== None. Description =========== - CVE-2015-1351 (denial of service) Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. - CVE-2015-1352 (denial of service) The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. - CVE-2015-2783 (out-of-bounds read) The vulnerability can be triggered when parsing a PHAR file at phar.c:623. The "buf_len" is obtained from the phar file and passed into php_var_unserialize() as the max argument. Under normal php_var_unserialize() circumstances, YYCURSOR will always be <= max. This however can be bypassed when processing a malform phar with a buf_len that is shorter then the string to be unserialized resulting in a memory info leak. Impact ====== A remote attacker is able to perform denial of service attacks via multiple vectors or use a crafted PHAR file to read beyond a buffer resulting in information disclosure. References ========== https://php.net/ChangeLog-5.php#5.6.8 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1351 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1352 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2783 https://bugs.php.net/bug.php?id=68677 https://bugs.php.net/bug.php?id=68741 https://bugs.php.net/bug.php?id=69324

1 0

[arch-security] CVEs in Arch Linux (current, future tracking)
by Ikey Doherty 16 Apr '15

16 Apr '15

Hi, Today I added initial PKGBUILD support to cve-check-tool [1], an automated CVE checking tool that works with the NVD Database, matching versions, etc, with a given source repository. Currently patch detection is very flaky, as there doesn't appear to be a consistent naming for CVE patches within Arch Linux. I would appreciate if someone could work with me to improve the patch detection within cve-check-tool, or work towards patch name standardisation within Arch Linux. Below is an initial list of CVEs I cannot determine are actually patched (by manually looking) - so some of them are potentially false positives. Also note that CVE name mapping (CPE fields) support isn't in cve-check-tool yet, this is something I'd also like to see Arch Linux implement to ensure a maximum surface area during checks. Note the following appeared for glibc, I haven't had time to check them: CVE-2014-7817 CVE-2014-8121 [1] https://github.com/ikeydoherty/cve-check-tool - ikey packages/ namespace: exiv2: CVE-2014-9449 libzip: CVE-2015-2331 htdig: CVE-2005-0085 gksu: CVE-2014-2886 cpio: CVE-2015-1197 libtar: CVE-2013-4420 mod_fcgid: CVE-2013-4365 net-snmp: CVE-2014-2285 arora: CVE-2011-3367 rsync: CVE-2014-9512 libarchive: CVE-2013-0211 CVE-2015-2304 vorbis-tools: CVE-2014-9638 CVE-2014-9640 id3lib: CVE-2007-4460 compface: CVE-2009-2286 procmail: CVE-2014-3618 xchat: CVE-2011-5129 vte: CVE-2012-2738 fcgi: CVE-2012-6687 fastjar: CVE-2010-0831 CVE-2010-2322 ppp: CVE-2014-3158 libyaml: CVE-2014-9130 potrace: CVE-2013-7437 unzip: CVE-2014-9636 lynx: CVE-2010-2810 community/ namespace: hsolink: CVE-2010-1671 CVE-201-2929 CVE-2010-2930 arpwatch: CVE-2012-2653 echoping: CVE-2010-5111 vsftpd: CVE-2015-1419 imlib: CVE-2007-3568 uudeview: CVE-2008-2266 clearsilver: CVE-2011-4357 dtach: CVE-2012-3368 devil: CVE-2009-3994 libnids: CVE-2010-0751 tuxguitar: CVE-2010-3385 pstotext: CVE-2006-5869 plib: CVE-2011-4620 CVE-2012-4552 dopewars: CVE-2009-3591 xloadimage: CVE-2001-0775 CVE-2005-3178 xv: CVE-2004-1726 CVE-2004-1726 CVE-2005-0665 trickle: CVE-2009-0415 P.S. Apologies if message comes through twice, issues.

3 7

[arch-security] [ASA-201504-13] ruby: permissive certificate verification
by Levente Polyak 14 Apr '15

14 Apr '15

Arch Linux Security Advisory ASA-201504-13 ========================================== Severity: Medium Date : 2015-04-14 CVE-ID : CVE-2015-1855 Package : ruby Type : permissive certificate verification Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ruby before version 2.2.2-1 is vulnerable to permissive certificate verification via matching of hostnames. Resolution ========== Upgrade to 2.2.2-1. # pacman -Syu "ruby>=2.2.2-1" The problem has been fixed upstream in version 2.2.2. Workaround ========== None. Description =========== After reviewing RFC 6125 and RFC 5280, multiple violations were found of matching hostnames and particularly wildcard certificates. Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching of more than one wildcard per subject/SAN is no-longer allowed. As well, comparison of these values are now case-insensitive. This change will take affect Ruby’s OpenSSL::SSL#verify_certificate_identity behavior. Specifically: - Only one wildcard character in the left-most part of the hostname is allowed. - IDNA names can now only be matched by a simple wildcard (e.g. ‘*.domain’). - Subject/SAN should be limited to ASCII characters only. Impact ====== A remote attacker can make use of the overly permissive hostname matching during certificate verifications to perform a man-in-the-middle attack by spoofing SSL servers via a crafted certificate. References ========== https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching… https://access.redhat.com/security/cve/CVE-2015-1855 https://bugs.ruby-lang.org/issues/9644

1 0

[arch-security] [ASA-201504-12] icecast: denial of service
by Christian Rebischke 11 Apr '15

11 Apr '15

Arch Linux Security Advisory ASA-201504-12 ========================================= Severity: Medium Date : 2015-04-11 CVE-ID : CVE-2015-3026 Package : icecast Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package icecast before version 2.4.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "icecast>=2.4.2-1" The problem has been fixed upstream in version 2.4.2. Workaround ========== None. Description =========== CVE-2015-3026 (denial of service): The bug can only be triggered if "stream_auth" is being used. This means, that all installations that use a default configuration are NOT affected.The default configuration only uses <source-password>. Neither are simple mountpoints affected that use <password>. A workaround, if installing an updated package is not possible, is to disable "stream_auth"and use <password> instead. As far as we understand the bug only leads to a simple remote denial of service. The underlying issue is a null pointer dereference. For clarity: No remote code execution should be possible, server just segfaults. Impact ====== An attacker could kill, with triggering the server with a special URL, the icecast-server due to a null pointer dereference. References ========== http://seclists.org/oss-sec/2015/q2/78 http://seclists.org/oss-sec/2015/q2/80 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3026 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782120 https://trac.xiph.org/ticket/2191 http://lists.xiph.org/pipermail/icecast-dev/2015-April/002460.html https://trac.xiph.org/changeset/27abfbbd688df3e3077b535997330aa06603250f/ic…

1 0

[arch-security] [ASA-201504-11] mediawiki: multiple issues
by Levente Polyak 09 Apr '15

09 Apr '15

Arch Linux Security Advisory ASA-201504-11 ========================================== Severity: Medium Date : 2015-04-10 CVE-ID : CVE-2015-2931 CVE-2015-2932 CVE-2015-2933 CVE-2015-2934 CVE-2015-2935 CVE-2015-2936 CVE-2015-2937 CVE-2015-2938 CVE-2015-2939 CVE-2015-2940 CVE-2015-2941 CVE-2015-2942 Package : mediawiki Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mediawiki before version 1.24.2-1 is vulnerable to multiple issues including but not limited to cross-side scripting, external resource loading, cross-side request forgery and denial of service. Resolution ========== Upgrade to 1.24.2-1. # pacman -Syu "mediawiki>=1.24.2-1" The problems have been fixed upstream in version 1.24.2. Workaround ========== None. Description =========== - CVE-2015-2931 (cross-side scripting) It was discovered that MIME types were not properly restricted, allowing a way to circumvent the SVG MIME blacklist for embedded resources. This allowed an attacker to embed JavaScript in a SVG file. - CVE-2015-2932 (cross-side scripting) The SVG filter to prevent injecting JavaScript using animate elements was incorrect. The list of dangerous parts of HTML5 is supposed to include all uses of 'animate attributename="xlink:href"' in SVG documents. - CVE-2015-2933 (cross-side scripting) A persistent XSS vulnerability was discovered due to the way attributes were expanded in MediaWiki's HTML class, in combination with LanguageConverter substitutions. - CVE-2015-2934 (cross-side scripting) It was discovered that MediaWiki's SVG filtering could be bypassed with entity encoding under the Zend interpreter. This could be used to inject JavaScript. - CVE-2015-2935 (external resource loading) A way was discovered to bypass the style filtering for SVG files to load external resource. This could violate the anonymity of users viewing the SVG. This issue exists because of an incomplete fix for CVE-2014-7199. - CVE-2015-2936 (denial of service) It was discovered that MediaWiki versions using PBKDF2 for password hashing (the default since 1.24) are vulnerable to DoS attacks using extremely long passwords. - CVE-2015-2937 (denial of service) It was discovered that MediaWiki is vulnerable to "Quadratic Blowup" denial of service attacks. - CVE-2015-2938 (cross-side scripting) It was discovered that the MediaWiki feature allowing a user to preview another user's custom JavaScript could be abused for privilege escalation. This feature has been removed. - CVE-2015-2939 (cross-side scripting) It was discovered that function names were not sanitized in Lua error backtraces, which could lead to XSS. - CVE-2015-2940 (cross-side request forgery) It was discovered that the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users. Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise. - CVE-2015-2941 (cross-side scripting) It was discovered that XSS is possible in the way api errors were reflected under HHVM versions before 3.6.1. MediaWiki now detects and mitigates this issue on older versions of HHVM. - CVE-2015-2942 (denial of service) It was discovered that MediaWiki's SVG and XMP parsing running under HHVM was susceptible to "Billion Laughs" DoS attacks. Impact ====== A remote attacker is able to perform cross-side scripting, external resource loading, cross-side request forgery and denial of service via various vectors. References ========== https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.… http://seclists.org/oss-sec/2015/q2/61 https://access.redhat.com/security/cve/CVE-2015-2931 https://access.redhat.com/security/cve/CVE-2015-2932 https://access.redhat.com/security/cve/CVE-2015-2933 https://access.redhat.com/security/cve/CVE-2015-2934 https://access.redhat.com/security/cve/CVE-2015-2935 https://access.redhat.com/security/cve/CVE-2015-2936 https://access.redhat.com/security/cve/CVE-2015-2937 https://access.redhat.com/security/cve/CVE-2015-2938 https://access.redhat.com/security/cve/CVE-2015-2939 https://access.redhat.com/security/cve/CVE-2015-2940 https://access.redhat.com/security/cve/CVE-2015-2941 https://access.redhat.com/security/cve/CVE-2015-2942

1 0

[arch-security] [ASA-201504-10] libssh2: out-of-bounds read
by Levente Polyak 09 Apr '15

09 Apr '15

Arch Linux Security Advisory ASA-201504-10 ========================================== Severity: Medium Date : 2015-04-09 CVE-ID : CVE-2015-1782 Package : libssh2 Type : out-of-bounds read Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libssh2 before version 1.5.0-1 is vulnerable to out-of-bounds read leading to denial of service and information disclosure. Resolution ========== Upgrade to 1.5.0-1. # pacman -Syu "libssh2>=1.5.0-1" The problem has been fixed upstream in version 1.5.0. Workaround ========== None. Description =========== When negotiating a new SSH session with a remote server, one of libssh2's functions for doing the key exchange (kex_agree_methods()) was naively reading data from the incoming packet and using it without doing sufficient range checks. The SSH_MSG_KEXINIT packet arrives to libssh2 with a set of strings, sent as a series of LENGTH + DATA pairs. libssh2 would go through the list and read the LENGTH field, read the string following the LENGTH and then advance the pointer LENGTH bytes in memory and expect to find the next LENGTH + DATA pair there. Then move on until seven subsequent strings are taken care of. It would naively assume that the (unsigned 32 bit) LENGTH fields were valid. This packet arrives in the negotiating phase so the remote server has not yet been deemed to be a known or trusted party. Impact ====== A remote attacker could man-in-the-middle a real server and cause libssh2 using clients to crash, resulting in denial of service, or otherwise read and use completely unintended memory areas in this process. References ========== http://www.libssh2.org/adv_20150311.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1782 https://bugs.archlinux.org/task/44146

1 0

[arch-security] [ASA-201504-9] chrony: denial of service
by Christian Rebischke 08 Apr '15

08 Apr '15

Arch Linux Security Advisory ASA-201504-9 ========================================= Severity: Medium Date : 2015-04-08 CVE-ID : CVE-2015-1853 Package : chrony Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chrony before version 1.31.1-1 is vulnerable to denial of service Resolution ========== Upgrade to 1.31.1-1 # pacman -Syu "chrony>=1.31.1-1" The problem has been fixed upstream. Workaround ========== None. Description =========== CVE-2015-1853 (denial of service): This issue is similiar to the "ntp CVE-2015-1799"-issue. An attacker knowing that NTP hosts A and B are peering with each other (symmetric association) can send a packet to host A with source address of B which will set the NTP state variables on A to the values sent by the attacker. Host A will then send on its next poll to B a packet with originate timestamp that doesn't match the transmit timestamp of B and the packet will be dropped. If the attacker does this periodically for both hosts, they won't be able to synchronize to each other. This is a known denial-of-service attack Impact ====== CVE-2015-1853 (denial of service): An attacker could stop the synchronizing process of chrony. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1853 https://access.redhat.com/security/cve/CVE-2015-1853 http://seclists.org/oss-sec/2015/q2/63

1 0

[arch-security] revoke of [ASA-201504-9] due to wrong version number
by Christian Rebischke 08 Apr '15

08 Apr '15

Hello Guys, Sorry I did a mistake with the version number of chrony. I will rewrite the ASA and post it again best regards -------------------------------------------------------------- Christian Rebischke Website : www.nullday.de Twitter : @sh1bumi Jabber : shibumi(a)jabber.ccc.de PGP : 0x8D8172C8 Fingerprint: A224 6F57 FD0A AC81 3971 EEBE 5EDA 916B 3A2A 7C49 --------------------------------------------------------------

1 0

[arch-security] [ASA-201504-9] chrony: denial of service
by Christian Rebischke 08 Apr '15

08 Apr '15

Arch Linux Security Advisory ASA-201504-9 ========================================= Severity: Medium Date : 2015-04-08 CVE-ID : CVE-2015-1853 Package : chrony Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chrony before version 1.31-2 is vulnerable to denial of service Resolution ========== Upgrade to 1.31-2. # pacman -Syu "chrony>=1.31-2" The problem has been fixed upstream. Workaround ========== None. Description =========== CVE-2015-1853 (denial of service): This issue is similiar to the "ntp CVE-2015-1799"-issue. An attacker knowing that NTP hosts A and B are peering with each other (symmetric association) can send a packet to host A with source address of B which will set the NTP state variables on A to the values sent by the attacker. Host A will then send on its next poll to B a packet with originate timestamp that doesn't match the transmit timestamp of B and the packet will be dropped. If the attacker does this periodically for both hosts, they won't be able to synchronize to each other. This is a known denial-of-service attack Impact ====== CVE-2015-1853 (denial of service): An attacker could stop the synchronizing process of chrony. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1853 https://access.redhat.com/security/cve/CVE-2015-1853 http://seclists.org/oss-sec/2015/q2/63

1 0