May 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201505-11] wireshark-qt: denial of service
by Levente Polyak 15 May '15

15 May '15

Arch Linux Security Advisory ASA-201505-11 ========================================== Severity: Medium Date : 2015-05-15 CVE-ID : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-qt before version 1.12.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.5-1. # pacman -Syu "wireshark-qt>=1.12.5-1" The problems have been fixed upstream in version 1.12.5. Workaround ========== None. Description =========== - CVE-2015-3808 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3809 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3810 (denial of service) The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3811 (denial of service) The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3812 (denial of service) It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3813 (denial of service) It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3814 (denial of service) It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3815 (denial of service) It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to perform a denial of service attack by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file via various vectors. References ========== https://wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815

1 0

[arch-security] [ASA-201505-10] wireshark-cli: denial of service
by Levente Polyak 15 May '15

15 May '15

Arch Linux Security Advisory ASA-201505-10 ========================================== Severity: Medium Date : 2015-05-15 CVE-ID : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-cli before version 1.12.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.5-1. # pacman -Syu "wireshark-cli>=1.12.5-1" The problems have been fixed upstream in version 1.12.5. Workaround ========== None. Description =========== - CVE-2015-3808 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3809 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3810 (denial of service) The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3811 (denial of service) The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3812 (denial of service) It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3813 (denial of service) It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3814 (denial of service) It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3815 (denial of service) It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to perform a denial of service attack by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file via various vectors. References ========== https://wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815

1 0

[arch-security] [ASA-201505-9] qemu: arbitrary code execution
by Levente Polyak 14 May '15

14 May '15

Arch Linux Security Advisory ASA-201505-9 ========================================= Severity: Critical Date : 2015-05-14 CVE-ID : CVE-2015-3456 Package : qemu Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu before version 2.2.1-5 is vulnerable to arbitrary code execution in the context of the host’s hypervisor process. Resolution ========== Upgrade to 2.2.1-5. # pacman -Syu "qemu>=2.2.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port. QEMU’s virtual FDC uses a fixed-size buffer for storing these commands and their associated data parameters. The FDC keeps track of how much data to expect for each command and, after all expected data for a given command is received from the guest system, the FDC executes the command and clears the buffer for the next command. This buffer reset is performed immediately at the completion of processing for all FDC commands, except for two of the defined commands. An attacker can send these commands and specially crafted parameter data from the guest system to the FDC to overflow the data buffer and execute arbitrary code in the context of the host’s hypervisor process. Impact ====== A remote attacker is able to send FDC commands and specially crafted parameter data from the guest system to overflow the data buffer and execute arbitrary code in the context of the host’s hypervisor process. References ========== https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3456 https://github.com/qemu/qemu/commit/e90774626 https://bugs.archlinux.org/task/44954

1 0

[arch-security] QEMU venom vulnerability
by Mark Lee 14 May '15

14 May '15

To All, After the disclosure of the venom vulnerability in QEMU today; I'm wondering if the Arch version of qemu is vulnerable. The disclosure indicated that distros have been notified since 4/30/2015. Regards, Mark

3 5

[arch-security] [ASA-201505-8] tomcat6: denial of service
by Remi Gacogne 13 May '15

13 May '15

Arch Linux Security Advisory ASA-201505-8 ========================================= Severity: Low Date : 2015-05-13 CVE-ID : CVE-2014-0230 Package : tomcat6 Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat6 before version 6.0.44-1 is vulnerable to remote denial of service. Resolution ========== Upgrade to 6.0.44-1. # pacman -Syu "tomcat6>=6.0.44-1" The problem has been fixed upstream in version 6.0.44. Workaround ========== None. Description =========== When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection. Impact ====== A remote attacker can cause a denial of service by preventing a large number of connections from being closed. References ========== https://access.redhat.com/security/cve/CVE-2014-0230 https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44

1 0

[arch-security] [ASA-201505-7] firefox: multiple issues
by Remi Gacogne 13 May '15

13 May '15

Arch Linux Security Advisory ASA-201505-7 ========================================= Severity: Critical Date : 2015-05-13 CVE-ID : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711 CVE-2015-2712 CVE-2015-2713 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717 CVE-2015-2718 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 38.0-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 38.0-1. # pacman -Syu "firefox>=38.0-1" The problem has been fixed upstream in version 38.0. Workaround ========== None. Description =========== - CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and Firefox 38): Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported memory safety problems and crashes that affect Firefox ESR 31.6 and Firefox 37. - CVE-2015-2709 (Memory safety bugs fixed in Firefox 38): Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety problems and crashes that affect Firefox 37. - CVE-2015-2710 (Buffer overflow with SVG content and CSS): Using the Address Sanitizer tool, security researcher Atte Kettunen found a buffer overflow during the rendering of SVG format graphics when combined with specific CSS properties on a page. This results in a potentially exploitable crash. - CVE-2015-2711 (Referrer policy ignored when links opened by middle-click and context menu): Security researcher Alex Verstak reported that <meta name="referrer"> is ignored when a link is opened through the context menu or a middle-click by mouse. This means that, in some situations, the referrer policy is ignored when opening links in new tabs and may cause some pages to open without an HTTP Referer header being set according to the author's intended policy. - CVE-2015-2712 (Out-of-bounds read and write in asm.js validation): Security researcher Dougall Johnson reported an out-of-bounds read and write in asm.js during JavaScript validation due to an error in how heap lengths are defined. This results in a potentially exploitable crash and could allow for the reading of random memory which may contain sensitive data. - CVE-2015-2713 (Use-after-free during text processing with vertical text enabled): Security researcher Scott Bell used the Address Sanitizer tool to discover a use-after-free error during the processing of text when vertical text is enabled. This leads to a potentially exploitable crash. - CVE-2015-2715 (Use-after-free due to Media Decoder Thread creation during shutdown): Security researchers Tyson Smith and Jesse Schwartzentruber reported a use-after-free during the shutdown process. This was caused by a race condition when media decoder threads are created during the shutdown process in some circumstances. This leads to a potentially exploitable crash when triggered. - CVE-2015-2716 (Buffer overflow when parsing compressed XML): Security researcher Ucha Gobejishvili used the Address Sanitizer tool to find a buffer overflow while parsing compressed XML content. This was due to an error in how buffer space is created and modified when handling large amounts of XML data. This results in a potentially exploitable crash. - CVE-2015-2717 (Buffer overflow and out-of-bounds read while parsing MP4 video metadata): Security researcher laf.intel reported a buffer overflow and out-of-bounds read in the libstagefright library while parsing invalid metadata in MP4 video files. This can lead to a potentially exploitable crash. - CVE-2015-2718 (Untrusted site hosting trusted page can intercept webchannel responses): Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm handles message traffic. He found that when a trusted page is hosted within an <iframe> on an untrusted third-party untrusted framing page, the untrusted page could intercept webchannel responses meant for the trusted page, bypassing origin restrictions. Impact ====== A remote attacker can execute arbitrary code with the permission of the current firefox user by tricking him into visiting a website. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://access.redhat.com/security/cve/CVE-2015-2708 https://access.redhat.com/security/cve/CVE-2015-2709 https://access.redhat.com/security/cve/CVE-2015-2710 https://access.redhat.com/security/cve/CVE-2015-2711 https://access.redhat.com/security/cve/CVE-2015-2712 https://access.redhat.com/security/cve/CVE-2015-2713 https://access.redhat.com/security/cve/CVE-2015-2715 https://access.redhat.com/security/cve/CVE-2015-2716 https://access.redhat.com/security/cve/CVE-2015-2717 https://access.redhat.com/security/cve/CVE-2015-2718

1 0

[arch-security] [ASA-201505-6] docker: multiple issues
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-6 ========================================= Severity: High Date : 2015-05-08 CVE-ID : CVE-2015-3627 CVE-2015-3629 CVE-2015-3630 CVE-2015-3631 Package : docker Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package docker before version 1:1.6.1-1 is vulnerable to multiple issues including but not limited to privilege escalation, symlink traversal, unauthorized configuration modification, information disclosure and policy profile escalation. Resolution ========== Upgrade to 1:1.6.1-1. # pacman -Syu "docker>=1:1.6.1-1" The problems have been fixed upstream in version 1.6.1. Workaround ========== None. Description =========== - CVE-2015-3627 (privilege escalation) The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation. - CVE-2015-3629 (privilege escalation) Symlink traversal on container respawn allows local privilege escalation. Libcontainer version 1.6.0 introduced changes which facilitated a mount namespace breakout upon respawn of a container. This allowed malicious images to write files to the host system and escape containerization. - CVE-2015-3630 (unauthorized modification) Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. - CVE-2015-3631 (policy profile escalation) By allowing volumes to override files of /proc within a mount namespace, a user could specify arbitrary policies for Linux Security Modules, including setting an unconfined policy underneath AppArmor, or a docker_t policy for processes managed by SELinux. In all versions of Docker up until 1.6.1, it is possible for malicious images to configure volume mounts such that files of proc may be overridden. Impact ====== A remote attacker is able to escalate privileges via unsafe symlink traversal, modify the configuration of the host system or disclose information via specific writable descriptors in /proc or escalate the LSM policy profiles by overriding files of /proc. References ========== http://seclists.org/oss-sec/2015/q2/389 https://access.redhat.com/security/cve/CVE-2015-3627 https://access.redhat.com/security/cve/CVE-2015-3629 https://access.redhat.com/security/cve/CVE-2015-3630 https://access.redhat.com/security/cve/CVE-2015-3631

1 0

[arch-security] [ASA-201505-5] libtasn1: arbitrary code execution
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-5 ========================================= Severity: Critical Date : 2015-05-08 CVE-ID : CVE-2015-3622 Package : libtasn1 Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libtasn1 before version 4.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.5-1. # pacman -Syu "libtasn1>=4.5-1" The problem has been fixed upstream in version 4.5. Workaround ========== None. Description =========== A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded input. A specially crafted, DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash or, possibly, execute arbitrary code. The heap overflow happens in the function _asn1_extract_der_octet() that is called during decoding of DER-encoded input. Impact ====== A remote attacker is able to use a specially crafted certificate that is leading to arbitrary code execution during decoding. References ========== http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=f979435 https://access.redhat.com/security/cve/CVE-2015-3622

1 0

[arch-security] [ASA-201505-4] mariadb-clients: denial of service
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-4 ========================================= Severity: Medium Date : 2015-05-08 CVE-ID : CVE-2014-8964 Package : mariadb-clients Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb-clients before version 10.0.18-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.0.18-1. # pacman -Syu "mariadb-clients>=10.0.18-1" The problems have been fixed upstream in version 10.0.18. Workaround ========== None. Description =========== A heap-based buffer overflow was found in the way PCRE handled certain malformed regular expressions. This issue could cause a crash while parsing malicious regular expressions related to an assertion that allows zero repeats. Impact ====== A remote attacker is able to cause an application crash leading to denial of service via malicious regular expressions. References ========== https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8964

1 0

[arch-security] [ASA-201505-3] mariadb: denial of service
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-3 ========================================= Severity: Medium Date : 2015-05-08 CVE-ID : CVE-2014-8964 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2571 Package : mariadb Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb before version 10.0.18-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.0.18-1. # pacman -Syu "mariadb>=10.0.18-1" The problems have been fixed upstream in version 10.0.18. Workaround ========== None. Description =========== - CVE-2014-8964 (denial of service) A heap-based buffer overflow was found in the way PCRE handled certain malformed regular expressions. This issue could cause a crash while parsing malicious regular expressions related to an assertion that allows zero repeats. - CVE-2015-0499 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Federated. - CVE-2015-0501 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. - CVE-2015-0505 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : DDL. - CVE-2015-2571 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. Impact ====== A remote authenticated attacker is able to cause a server crash leading to denial of service via malicious regular expressions and various unspecified vectors. References ========== https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8964 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0499 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0501 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0505 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2571

1 0