June 2015 - Arch-security - lists.archlinux.org

[arch-security] Are you getting this?
by Allan McRae 29 Jun '15

29 Jun '15

I may have set it up correctly...

6 7

[arch-security] [ASA-201506-5] flashplugin: remote code execution
by Remi Gacogne 24 Jun '15

24 Jun '15

Arch Linux Security Advisory ASA-201506-5 ========================================= Severity: Critical Date : 2015-06-24 CVE-ID : CVE-2015-3113 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.468-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 11.2.202.468-1. # pacman -Syu "flashplugin>=11.2.202.468-1" The problem has been fixed upstream in version 11.2.202.468. Workaround ========== This issue can be mitigated by disabling the flash plugin. Description =========== A heap-based buffer overflow has been found in the FLV handling of Adobe Flash Player, leading to code execution. Impact ====== A remote attacker may be able to execute arbitrary code on a vulnerable host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-14.html https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3113

1 0

[arch-security] [ASA-201506-4] curl: information leakage
by Remi Gacogne 22 Jun '15

22 Jun '15

Arch Linux Security Advisory ASA-201506-4 ========================================= Severity: Medium Date : 2015-06-22 CVE-ID : CVE-2015-3236 CVE-2015-3237 Package : curl Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.43.0-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.43.0-1. # pacman -Syu "curl>=7.43.0-1" The problem has been fixed upstream in version 7.43.0. Workaround ========== None. Description =========== - CVE-2015-3236 (lingering HTTP credentials in connection re-use): libcurl can wrongly send HTTP credentials when re-using connections. libcurl allows applications to set credentials for the upcoming transfer with HTTP Basic authentication, like with CURLOPT_USERPWD for example. Name and password. Just like all other libcurl options the credentials are sticky and are kept associated with the "handle" until something is made to change the situation. Further, libcurl offers a curl_easy_reset() function that resets a handle back to its pristine state in terms of all settable options. A reset is of course also supposed to clear the credentials. A reset is typically used to clear up the handle and prepare it for a new, possibly unrelated, transfer. Within such a handle, libcurl can also store a set of previous connections in case a second transfer is requested to a host name for which an existing connection is already kept alive. With this flaw present, using the handle even after a reset would make libcurl accidentally use those credentials in a subsequent request if done to the same host name and connection as was previously accessed. An example case would be first requesting a password protected resource from one section of a web site, and then do a second request of a public resource from a completely different part of the site without authentication. This flaw would then inadvertently leak the credentials in the second request. - CVE-2015-3237 (SMB send off unrelated memory contents): libcurl can get tricked by a malicious SMB server to send off data it did not intend to. In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back. The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handcrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the values cause libcurl to access invalid memory. Impact ====== A passive remote adversary or a malicious HTTP server may be able to gather sensitive HTTP credentials. A malicious SMB server may be able to extract arbitrary memory content from a vulnerable SMB client using libcurl. References ========== http://curl.haxx.se/docs/adv_20150617A.html http://curl.haxx.se/docs/adv_20150617B.html https://access.redhat.com/security/cve/CVE-2015-3236 https://access.redhat.com/security/cve/CVE-2015-3237

1 0

[arch-security] [ASA-201506-3] openssl: multiple issues
by Levente Polyak 12 Jun '15

12 Jun '15

Arch Linux Security Advisory ASA-201506-3 ========================================= Severity: High Date : 2015-06-12 CVE-ID : CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-4000 Package : openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.b-1 is vulnerable to multiple issues including but not limited to man-in-the-middle via cipher downgrade, double free and denial of service. Resolution ========== Upgrade to 1.0.2.b-1. # pacman -Syu "openssl>=1.0.2.b-1" The problems have been fixed upstream in version 1.0.2.b. Workaround ========== None. Description =========== - CVE-2015-1788 (denial of service) When processing an ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service against any system which processes public keys, certificate requests or certificates. This includes TLS clients and TLS servers with client authentication enabled. - CVE-2015-1789 (out-of-bounds read) X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds. In addition, X509_cmp_time accepts an arbitrary number of fractional seconds in the time string. An attacker can use this to craft malformed certificates and CRLs of various sizes and potentially cause a segmentation fault, resulting in a DoS on applications that verify certificates or CRLs. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks. - CVE-2015-1790 (denial of service) The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected. - CVE-2015-1791 (double free) If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data. - CVE-2015-1792 (denial of service) When verifying a signedData message the CMS code can enter an infinite loop if presented with an unknown hash function OID. This can be used to perform denial of service against any system which verifies signedData messages using the CMS code. - CVE-2015-4000 (cipher downgrade) A vulnerability in the TLS protocol allows a man-in-the-middle attacker to downgrade vulnerable TLS connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. This vulnerability is known as Logjam. OpenSSL has added protection for TLS clients by rejecting handshakes with DH parameters shorter than 768 bits. This limit will be increased to 1024 bits in a future release. Impact ====== A remote attacker is able to perform man-in-the-middle via cipher downgrade, denial of service or possibly have other unspecified impact via various vectors. References ========== https://www.openssl.org/news/secadv_20150611.txt https://access.redhat.com/security/cve/CVE-2015-1788 https://access.redhat.com/security/cve/CVE-2015-1789 https://access.redhat.com/security/cve/CVE-2015-1790 https://access.redhat.com/security/cve/CVE-2015-1791 https://access.redhat.com/security/cve/CVE-2015-1792 https://access.redhat.com/security/cve/CVE-2015-4000

1 0

[arch-security] [ASA-201506-2] cups: multiple issues
by Levente Polyak 10 Jun '15

10 Jun '15

Arch Linux Security Advisory ASA-201506-2 ========================================= Severity: Critical Date : 2015-06-10 CVE-ID : CVE-2015-1158 CVE-2015-1159 Package : cups Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package cups before version 2.0.3-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation and cross-side scripting. Resolution ========== Upgrade to 2.0.3-1. # pacman -Syu "cups>=2.0.3-1" The problems have been fixed upstream in version 2.0.3. Workaround ========== None. Description =========== - CVE-2015-1158 (arbitrary code execution, privilege escalation) An issue with how localized strings are handled in cupsd allows a reference counter to over-decrement when handling certain print job request errors. As a result, an attacker can prematurely free an arbitrary string of global scope, creating a dangling pointer to a repurposed block of memory on the heap. The dangling pointer causes ACL verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL handling failure results in unrestricted access to privileged operations, allowing an unauthenticated remote user to upload a replacement CUPS configuration file and mount further attacks. - CVE-2015-1159 (cross-side scripting) A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. In certain cases, the CGI template can echo user input to file rather than escaping the text first. This may be used to set up a reflected XSS attack in the QUERY parameter of the web interface help page. By default, many linux distributions run with the web interface activated. Impact ====== A remote attacker is able to use a cross-side scripting flaw in order to send a malicious print request that is leading to arbitrary code execution and privilege escalation. References ========== https://www.cups.org/str.php?L4609 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159 https://bugs.archlinux.org/task/45279

1 0

[arch-security] [ASA-201506-1] pcre: buffer overflow
by Remi Gacogne 05 Jun '15

05 Jun '15

Arch Linux Security Advisory ASA-201506-1 ========================================= Severity: High Date : 2015-06-05 CVE-ID : CVE-2015-3210 Package : pcre Type : buffer overflow Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.37-2 is vulnerable to multiple buffer overflows leading to code execution. Resolution ========== Upgrade to 8.37-2. # pacman -Syu "pcre>=8.37-2" The problem has been fixed upstream in the trunk, but no fixed version has been released yet. Workaround ========== None. Description =========== Several buffer overflows have been found in pcre <= 8.37. By compiling a crafted regular expression, it is possible to write more than the expected size into various buffers, allowing arbitrary code execution. Impact ====== An attacker with the ability to submit an arbitrary regular expression for compilation can execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2015-3210 https://bugs.archlinux.org/task/45207 https://bugs.exim.org/show_bug.cgi?id=1636 http://www.securitytracker.com/id/1032453

1 0