July 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201507-23] pacman: silent downgrade
by Levente Polyak 29 Jul '15

29 Jul '15

Arch Linux Security Advisory ASA-201507-23 ========================================== Severity: High Date : 2015-07-29 CVE-ID : None Package : pacman Type : silent downgrade Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pacman before version 4.2.1-2 is vulnerable to silent downgrade via a man-in-the-middle attack. Resolution ========== Upgrade to 4.2.1-2. # pacman -Syu "pacman>=4.2.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw has been discovered in pacman that is leading to possible silent package downgrade when exploited. While loading each package it was not ensured that the internal version matches the expected database version, leading to the possibility to circumvent the version check. This issue can be used by an attacker to trick the software into installing an older version. This behavior can be exploited by a man-in-the-middle attack through specially crafted database tarball containing a higher version, yet actually delivering an older and vulnerable version, which was previously shipped. Impact ====== A remote attacker able to perform a man-in-the-middle attack is able to make use of a specially crafted database tarball to silently install an older and vulnerable version of a previously shipped package. References ========== https://lists.archlinux.org/pipermail/pacman-dev/2015-July/020238.html https://bugs.archlinux.org/task/45687

1 0

[arch-security] [ASA-201507-22] bind: denial of service
by Levente Polyak 29 Jul '15

29 Jul '15

Arch Linux Security Advisory ASA-201507-22 ========================================== Severity: High Date : 2015-07-29 CVE-ID : CVE-2015-5477 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.2.P3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.2.P3-1. # pacman -Syu "bind>=9.10.2.P3-1" The problem has been fixed upstream in version 9.10.2.P3. Workaround ========== None. Description =========== A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named (functioning as an authoritative DNS server or a DNS resolver) exit unexpectedly with an assertion failure via a specially crafted DNS request packet leading to denial of service. Impact ====== A remote attacker is able to trigger an assertion failure via a specially crafted DNS request packet that is resulting in unexpected application crash leading to denial of service. References ========== https://kb.isc.org/article/AA-01272/0 https://access.redhat.com/security/cve/CVE-2015-5477

1 0

[arch-security] [ASA-201507-21] qemu: multiple issues
by Levente Polyak 29 Jul '15

29 Jul '15

Arch Linux Security Advisory ASA-201507-21 ========================================== Severity: Critical Date : 2015-07-29 CVE-ID : CVE-2015-3214 CVE-2015-5154 CVE-2015-5158 Package : qemu Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu before version 2.3.0-5 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.3.0-5. # pacman -Syu "qemu>=2.3.0-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-3214 (information disclosure, arbitrary code execution) An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pit_ioport_read() function. A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare cases, use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process. - CVE-2015-5154 (arbitrary code execution) A heap overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. - CVE-2015-5158 (denial of service) This is a guest-triggerable buffer overflow. The scsi_cdb_length returns -1 as an error value, but the caller does not check it. Luckily, the massive overflow means that QEMU will just SIGSEGV, leading to denial of service of the guest system. Impact ====== A remote attacker is able to execute arbitrary code and take over the qemu process elevating its privilege to that of the qemu process or perform a denial of service attack to crash the guest system. References ========== http://xenbits.xen.org/xsa/advisory-138.html https://access.redhat.com/security/cve/CVE-2015-3214 https://access.redhat.com/security/cve/CVE-2015-5154 https://access.redhat.com/security/cve/CVE-2015-5158 https://github.com/qemu/qemu/commit/d4862a87e31a https://github.com/qemu/qemu/commit/c170aad8b057 https://github.com/qemu/qemu/commit/d2ff85854512 https://github.com/qemu/qemu/commit/cb72cba83021 https://github.com/qemu/qemu/commit/03441c3a4a42

1 0

[arch-security] [ASA-201507-20] crypto++: private key recovery
by Levente Polyak 24 Jul '15

24 Jul '15

Arch Linux Security Advisory ASA-201507-20 ========================================== Severity: Medium Date : 2015-07-24 CVE-ID : CVE-2015-2141 Package : crypto++ Type : private key recovery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package crypto++ before version 5.6.2-3 is vulnerable to private key recovery via a timing side-channel attack. Resolution ========== Upgrade to 5.6.2-3. # pacman -Syu "crypto++>=5.6.2-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Evgeny Sidorov discovered that it is possible to recover the private key when using Rabin-Williams signatures due to a bad interaction with the blinding value used to mask private key operations. The bad interaction had to do with the random value not meeting certain Jacobi requirements, which allows remote attackers to obtain private keys via a timing attack. Impact ====== A remote attacker is able to take advantage of improper private key blinding operations to recover private keys via a timing side-channel attack. References ========== https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2015-June/015585.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2141 https://bugs.archlinux.org/task/45498

1 0

[arch-security] [ASA-201507-19] libuser: multiple issues
by Levente Polyak 24 Jul '15

24 Jul '15

Arch Linux Security Advisory ASA-201507-19 ========================================== Severity: Critical Date : 2015-07-24 CVE-ID : CVE-2015-3245 CVE-2015-3246 Package : libuser Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libuser before version 0.62-1 is vulnerable to privilege escalation and denial of service. Resolution ========== Upgrade to 0.62-1. # pacman -Syu "libuser>=0.62-1" The problems have been fixed upstream in version 0.62. Workaround ========== None. Description =========== - CVE-2015-3245 (denial of service) It was found that libuser, as used by the chfn userhelper functionality, did not properly filter out newline characters in GECOS fields. A local, authenticated user could use this flaw to corrupt the /etc/passwd file, resulting in a denial-of-service on the system. - CVE-2015-3246 (privilege escalation) A flaw was found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser (for example, userhelper) to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate their privileges to root. Impact ====== A local authenticated user is able to use an application compiled against libuser to escalate privileges to root or perform a denial-of-service attack on the system by corrupting the /etc/passwd file. References ========== http://seclists.org/oss-sec/2015/q3/185 https://access.redhat.com/security/cve/CVE-2015-3245 https://access.redhat.com/security/cve/CVE-2015-3246

1 0

[arch-security] [ASA-201507-17] openssh: authentication limits bypass
by Levente Polyak 23 Jul '15

23 Jul '15

Arch Linux Security Advisory ASA-201507-17 ========================================== Severity: Medium Date : 2015-07-23 CVE-ID : CVE-2015-5600 Package : openssh Type : authentication limits bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 6.9p1-2 is vulnerable to authentication limits bypass. Resolution ========== Upgrade to 6.9p1-2. # pacman -Syu "openssh>=6.9p1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== In case that public key authentication is properly configured and no challenge-response authentication is required, deactivating challenge-response and kbd-interactive authentication in /etc/ssh/sshd_config via the following property mitigates this issue: KbdInteractiveAuthentication no ChallengeResponseAuthentication no Description =========== The OpenSSH server normally wouldn't allow successive authentications that exceed the MaxAuthTries setting in sshd_config, however when using kbd-interactive challenge-response authentication the allowed login retries can be extended limited only by the LoginGraceTime setting, that can be more than 10000 tries (depends on the network speed), and even more for local attacks. Impact ====== A remote attacker is able to perform a brute-force attack by bypassing the authentication limits via keyboard-interactive challenge-response authentication. References ========== http://seclists.org/fulldisclosure/2015/Jul/92 https://access.redhat.com/security/cve/CVE-2015-5600

1 0

[arch-security] [ASA-201507-18] chromium: multiple issues
by Remi Gacogne 23 Jul '15

23 Jul '15

Arch Linux Security Advisory ASA-201507-18 ========================================== Severity: High Date : 2015-07-23 CVE-ID : CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273 CVE-2015-1274 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278 CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282 CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286 CVE-2015-1287 CVE-2015-1288 CVE-2015-1289 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 44.0.2403.89-1 is vulnerable to multiple issues including but not limited to denial of service, CSP and SOP bypass and spell-checking dictionaries hijack. Resolution ========== Upgrade to 44.0.2403.89-1. # pacman -Syu "chromium>=44.0.2403.89-1" The problem has been fixed upstream in version 44.0.2403.89. Workaround ========== None. Description =========== - CVE-2015-1270: Uninitialized memory read in ICU. - CVE-2015-1271: Heap overflow in pdfium. - CVE-2015-1272, CVE-2015-1273, CVE-2015-1279: Use-after-free related to unexpected GPU process termination. - CVE-2015-1274: Settings allowed executable files to run immediately after download. - CVE-2015-1276 : Use-after-free in IndexedDB. - CVE-2015-1277: Use-after-free in accessibility. - CVE-2015-1278: URL spoofing using pdf files. - CVE-2015-1280: Memory corruption in skia. - CVE-2015-1281: CSP bypass. - CVE-2015-1282: Use-after-free in pdfium. - CVE-2015-1283: Heap-buffer-overflow in expat. - CVE-2015-1284: Use-after-free in blink. - CVE-2015-1285: Information leak in XSS auditor. - CVE-2015-1286: UXSS in blink. - CVE-2015-1287: SOP bypass with CSS. - CVE-2015-1288: Spell checking dictionaries fetched over HTTP. - CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass the Same-Origin Policy or the Content Security Policy of a website, hijack spell-checking dictionaries, cause a denial of service or have other unspecified impact. References ========== http://googlechromereleases.blogspot.fr/2015/07/stable-channel-update_21.ht… https://access.redhat.com/security/cve/CVE-2015-1270 https://access.redhat.com/security/cve/CVE-2015-1271 https://access.redhat.com/security/cve/CVE-2015-1272 https://access.redhat.com/security/cve/CVE-2015-1273 https://access.redhat.com/security/cve/CVE-2015-1274 https://access.redhat.com/security/cve/CVE-2015-1276 https://access.redhat.com/security/cve/CVE-2015-1277 https://access.redhat.com/security/cve/CVE-2015-1278 https://access.redhat.com/security/cve/CVE-2015-1279 https://access.redhat.com/security/cve/CVE-2015-1280 https://access.redhat.com/security/cve/CVE-2015-1281 https://access.redhat.com/security/cve/CVE-2015-1282 https://access.redhat.com/security/cve/CVE-2015-1283 https://access.redhat.com/security/cve/CVE-2015-1284 https://access.redhat.com/security/cve/CVE-2015-1285 https://access.redhat.com/security/cve/CVE-2015-1286 https://access.redhat.com/security/cve/CVE-2015-1287 https://access.redhat.com/security/cve/CVE-2015-1288 https://access.redhat.com/security/cve/CVE-2015-1289

1 0

[arch-security] [ASA-201507-16] jre7-openjdk: multiple issues
by Remi Gacogne 22 Jul '15

22 Jul '15

Arch Linux Security Advisory ASA-201507-16 ========================================== Severity: Critical Date : 2015-07-22 CVE-ID : CVE-2015-2590 CVE-2015-2601 CVE-2015-2613 CVE-2015-2621 CVE-2015-2625 CVE-2015-2628 CVE-2015-2632 CVE-2015-2808 CVE-2015-4000 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Package : jre7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u85_2.6.1-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 7.u85_2.6.1-1. # pacman -Syu "jre7-openjdk>=7.u85_2.6.1-1" The problem has been fixed upstream in version 7.u85 of OpenJDK and 2.6.1 of IcedTea. Workaround ========== None. Description =========== - CVE-2015-2590 (deserialization issue in ObjectInputStream.readSerialData()): ObjectInputStream's readSerialData() could, in certain cases, incorrectly perform deserialization of data from serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-2601 (non-constant time comparisons in crypto code): It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. - CVE-2015-2613 (NSS / JCE: missing EC parameter validation in ECDH_Derive()): It was discovered that the Elliptic Curve (EC) cryptography code as used in Mozilla NSS (Network Security Services) library and OpenJDK JCE (Java Cryptography Extension) component failed to properly validate EC parameters as used in ECDH_Derive() function, which performs ECDH (Elliptic Curve Diffie-Hellman) key derivation. A remote attacker could use this flaw to disclose sensitive information. - CVE-2015-2621 (incorrect code permission checks in RMIConnectionImpl): It was discovered that the RMIConnectionImpl class in the JMX component of OpenJDK failed to properly check code permissions when creating repository class loaders. An untrusted Java application or applet could use this flaw to read information access to which should be restricted by the Java sandbox, partially bypassing sandbox restrictions. - CVE-2015-2625 (name for reverse DNS lookup used in certificate identity check): A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identify verification when establishing TLS/SSL connection to a host identified using IP address. In certain cases, it would incorrectly use a host name obtained after performing reverse DNS lookup of the specified IP address rather than the original IP address for the identity check, possibly leading to having a certificate issued for different identity to be accepted as valid. This issue is know to affect cases when SSLSocketFactory.createSocket() is called with certain InetAddress instances. It is not known to affect cases when target host IP is passed to createSocket() as string, or when IP is used in URL used for HttpsURLConnection. With this patch, reverse DNS lookup is no longer performed. The fix also adds new system property jdk.tls.trustNameService that can be used to allow the DNS lookup to be performed and hence have its result used during identity check. - CVE-2015-2628 (IIOPInputStream type confusion vulnerability): It was discovered that the IIOPInputStream class in the CORBA component in OpenJDK failed to properly check object field types. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-2632 (integer overflow in LETableReference verifyLength()): An integer overflow flaw, leading to out-of-bounds read, was found in the LETableReference's verifyLength() method. A specially crafted file could cause an application using ICU to parse untrusted font files to perform an invalid memory access, leading to crash and possibly disclosure of portion of application memory. ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-2808 (prohibit RC4 cipher suites): It was discovered that the Invariance Weakness of the RC4 stream cipher could be used to recover plaintext from a TLS connection, when RC4 encryption is used. "The Invariance Weakness is an L-shape key pattern in RC4 keys, which once it exists in an RC4 key, preserves part of the state permutation intact throughout the initialization process. This intact part includes the least significant bits of the permutation, when processed by the PRGA algorithm, determines the least significant bits of the allegedly pseudo-random output stream along a long prefix of the stream." This can lead to significant leakage of plaintext bytes from the ciphertext. - CVE-2015-4000 (make jdk8 mode the default for jdk.tls.ephemeralDHKeySize): Prevent logjam attack TLS connections using Diffie-Hellman key exchange protocol were found to be vulnerable to an attack, in which a man-in-the-middle attacker could downgrade vulnerable TLS connections to 512-bit export-grade cryptography. The attack affects any server that supports DHE_EXPORT ciphers. - CVE-2015-4731 (improper permission checks in MBeanServerInvocationHandler): It was discovered that the JMX component in OpenJDK failed to properly handle MBean connection proxy classes. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4732 (insufficient context checks during object deserialization): It was discovered that the Libraries component of OpenJDK failed to check current context / thread while performing object deserialization, possibly leading to incorrect input deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4733 (RemoteObjectInvocationHandler allows calling finalize()): It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not prevent calls to the finalize() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4748 (incorrect OCSP nextUpdate checking): A flaw was found in the way the Libraries component of OpenJDK verified OCSP (Online Certificate Status Protocol) response. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity. This could allow a Java application to accept a revoked X.509 certificate as valid if it was presented with an OCSP response generated before certificate revocation. - CVE-2015-4749 (DnsClient fails to release request information after error): It was discovered that the DnsClient client class in the JNDI (Java Naming and Directory Interface) component in OpenJDK failed to properly remove information about an outgoing DNS request from the list of outstanding DNS requests when certain errors occurred during DNS resolution. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and possibly block further DNS resolution (after exhausting all DNS transaction ids). - CVE-2015-4760 (missing boundary checks in layout engine): It was discovered that ICU Layout Engine was missing multiple boundary checks. These could lead to buffer overflows and JVM memory corruption. A specially crafted file could cause an application using ICU to parse untrusted font files to crash and, possibly, execute arbitrary code. ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker can execute arbitrary code on an affected host. References ========== http://blog.fuseyism.com/index.php/2015/07/21/security-icedtea-2-6-1-for-op… http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-updat… https://access.redhat.com/security/cve/CVE-2015-2590 https://access.redhat.com/security/cve/CVE-2015-2601 https://access.redhat.com/security/cve/CVE-2015-2613 https://access.redhat.com/security/cve/CVE-2015-2621 https://access.redhat.com/security/cve/CVE-2015-2625 https://access.redhat.com/security/cve/CVE-2015-2628 https://access.redhat.com/security/cve/CVE-2015-2632 https://access.redhat.com/security/cve/CVE-2015-2808 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2015-4731 https://access.redhat.com/security/cve/CVE-2015-4732 https://access.redhat.com/security/cve/CVE-2015-4733 https://access.redhat.com/security/cve/CVE-2015-4748 https://access.redhat.com/security/cve/CVE-2015-4749 https://access.redhat.com/security/cve/CVE-2015-4760

1 0

[arch-security] [ASA-201507-15] apache: multiple issues
by Remi Gacogne 17 Jul '15

17 Jul '15

Arch Linux Security Advisory ASA-201507-15 ========================================== Severity: Medium Date : 2015-07-17 CVE-ID : CVE-2015-0228 CVE-2015-0253 CVE-2015-3183 CVE-2015-3185 Package : apache Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package apache before version 2.4.16-1 is vulnerable to multiple issues including remote denial of service and authentication bypass. Resolution ========== Upgrade to 2.4.16-1. # pacman -Syu "apache>=2.4.16-1" The problem has been fixed upstream in version 2.4.16. Workaround ========== None. Description =========== - CVE-2015-0228 (denial of service): mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash. - CVE-2015-0253 (denial of service): Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in 2.4.11. PR 57531. - CVE-2015-3183 (denial of service): core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters. - CVE-2015-3185 (authentication bypass): Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook. Impact ====== A remote attacker might be able to bypass authentication required by a module incorrectly updated for 2.4.x, or crash the apache httpd server. References ========== https://access.redhat.com/security/cve/CVE-2015-0228 https://access.redhat.com/security/cve/CVE-2015-0253 https://access.redhat.com/security/cve/CVE-2015-3183 https://access.redhat.com/security/cve/CVE-2015-3185 http://www.apache.org/dist/httpd/CHANGES_2.4.16 https://bz.apache.org/bugzilla/show_bug.cgi?id=57531

1 0

[arch-security] [ASA-201507-14] lib32-flashplugin: arbitrary code execution
by Levente Polyak 16 Jul '15

16 Jul '15

Arch Linux Security Advisory ASA-201507-14 ========================================== Severity: Critical Date : 2015-07-16 CVE-ID : CVE-2015-5122 CVE-2015-5123 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.491-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.491-1. # pacman -Syu "lib32-flashplugin>=11.2.202.491-1" The problems have been fixed upstream in version 11.2.202.491. Workaround ========== None. Description =========== - CVE-2015-5122 (arbitrary code execution) Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property. - CVE-2015-5123 (arbitrary code execution) Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function. Impact ====== A remote attacker is able to use a specially crafted flash application to execute arbitrary code. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-18.html https://access.redhat.com/security/cve/CVE-2015-5122 https://access.redhat.com/security/cve/CVE-2015-5123

1 0