January 2016 - Arch-security - lists.archlinux.org

[arch-security] [Announcement] Discussion about restricting arch-security for public participation
by Levente Polyak 18 Feb '16

18 Feb '16

Dear arch-security subscribers, Dear arch-general subscribers, the policy of the arch-security mailinglist is currently changed to a restricted advisory announcements only list due to certain reason roughly explained on the arch-devops [0] and arch-dev-public [1] lists. As there was no announcement and discussion about this change yet, we want to invite you to discuss the restriction of the arch-security mailinglist on the CC-ed arch-general list. After making sure you are subscribed to arch-general [2], you can simply reply to this announcement by posting directly to the arch-general mailinglist. Our main goal behind this change is to separate relevant official announcements and advisories from possibly long and frequent discussions. The security teams idea is that each announcement to the arch-security list should be considered as an urgent alert and reviewed as soon as possible, without the need to filter them from general conversations and exchange of "unverified" information. sincerely, Levente (anthraxx) [0] https://lists.archlinux.org/pipermail/arch-devops/2016-January/000007.html [1] https://lists.archlinux.org/pipermail/arch-dev-public/2015-December/027581.… [2] https://lists.archlinux.org/listinfo/arch-general

1 1

[arch-security] [ASA-201601-33] lib32-openssl: man-in-the-middle
by Levente Polyak 29 Jan '16

29 Jan '16

Arch Linux Security Advisory ASA-201601-33 ========================================== Severity: High Date : 2016-01-29 CVE-ID : CVE-2015-3197 CVE-2015-4000 CVE-2016-0701 Package : lib32-openssl Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-openssl before version 1.0.2.f-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1.0.2.f-1. # pacman -Syu "lib32-openssl>=1.0.2.f-1" The problems have been fixed upstream in version 1.0.2.f. Workaround ========== None. Description =========== - CVE-2015-3197 (man-in-the-middle) A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. - CVE-2015-4000 (man-in-the-middle) A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic. - CVE-2016-0701 (man-in-the-middle) It was found that OpenSSL used weak Diffie-Hellman parameters based on unsafe primes, which were generated and stored in X9.42-style parameter files. An attacker who could force the peer to perform multiple handshakes using the same private DH component could use this flaw to conduct man-in-the-middle attacks on the SSL/TLS connection. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-3197 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2016-0701 https://openssl.org/news/secadv/20160128.txt

1 0

[arch-security] [ASA-201601-32] openssl: man-in-the-middle
by Levente Polyak 29 Jan '16

29 Jan '16

Arch Linux Security Advisory ASA-201601-32 ========================================== Severity: High Date : 2016-01-29 CVE-ID : CVE-2015-3197 CVE-2015-4000 CVE-2016-0701 Package : openssl Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.f-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1.0.2.f-1. # pacman -Syu "openssl>=1.0.2.f-1" The problems have been fixed upstream in version 1.0.2.f. Workaround ========== None. Description =========== - CVE-2015-3197 (man-in-the-middle) A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. - CVE-2015-4000 (man-in-the-middle) A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic. - CVE-2016-0701 (man-in-the-middle) It was found that OpenSSL used weak Diffie-Hellman parameters based on unsafe primes, which were generated and stored in X9.42-style parameter files. An attacker who could force the peer to perform multiple handshakes using the same private DH component could use this flaw to conduct man-in-the-middle attacks on the SSL/TLS connection. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-3197 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2016-0701 https://openssl.org/news/secadv/20160128.txt

1 0

[arch-security] [ASA-201601-31] nginx: denial of service
by Christian Rebischke 27 Jan '16

27 Jan '16

Arch Linux Security Advisory ASA-201601-31 ========================================== Severity: Medium Date : 2016-01-27 CVE-ID : CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 Package : nginx Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nginx before version 1.8.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.8.1-1 # pacman -Syu "nginx>=1.8.1-1" The problems have been fixed upstream in version 1.8.1. Workaround ========== None. Description =========== - CVE-2016-0742 (denial of service) Invalid pointer dereference might occur during DNS server response processing if the "resolver" directive was used, allowing an attacker who is able to forge UDP packets from the DNS server to cause segmentation fault in a worker process. - CVE-2016-0746 (denial of service) Use-after-free condition might occur during CNAME response processing if the "resolver" directive was used, allowing an attacker who is able to trigger name resolution to cause segmentation fault in a worker process, or might have potential other impact. - CVE-2016-0747 (denial of service) CNAME resolution was insufficiently limited if the "resolver" directive was used, allowing an attacker who is able to trigger arbitrary name resolution to cause excessive resource consumption in worker processes. Impact ====== A remote attacker is able to cause a segmentation fault and crash the server. References ========== http://mailman.nginx.org/pipermail/nginx-announce/2016/000168.html

1 0

[arch-security] [ASA-201601-30] blueman: privilege escalation
by Remi Gacogne 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-30 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2015-8612 Package : blueman Type : privilege escalation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package blueman before version 2.0.3-1 is vulnerable to local privilege escalation. Resolution ========== Upgrade to 2.0.3-1. # pacman -Syu "blueman>=2.0.3-1" The problem has been fixed upstream in version 2.0.3. Workaround ========== None. Description =========== A local privilege escalation vulnerability has been found in the Network::EnableNetwork() method of blueman. An unsanitized string is received over DBUS into the dhcp_handler parameter and passed to eval(), thus allowing arbitrary command execution with the privileges of the user running blueman. Impact ====== A local attacker can use this vulnerability to get root access on the affected host. References ========== https://bugs.archlinux.org/task/47784 https://access.redhat.com/security/cve/CVE-2015-8612 https://github.com/blueman-project/blueman/issues/416 https://github.com/blueman-project/blueman/commit/e3d249391654da3fefe08b538…

1 0

[arch-security] [ASA-201601-29] mbedtls: man-in-the-middle
by Remi Gacogne 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-29 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2015-7575 Package : mbedtls Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mbedtls before version 2.2.1-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 2.2.1-1. # pacman -Syu "mbedtls>=2.2.1-1" The problem has been fixed upstream in version 2.2.1. Workaround ========== None. Description =========== mbedTLS before 2.2.1 is vulnerable to the SLOTH attack, breaking MD5 signatures potentially used during TLS 1.2 handshakes to impersonate a TLS server. Impact ====== A remote attacker might be able to impersonate a TLS server, acting as a man-in-the-middle. References ========== https://bugs.archlinux.org/task/47783 https://access.redhat.com/security/cve/CVE-2015-7575 http://www.mitls.org/pages/attacks/SLOTH https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-p…

1 0

[arch-security] [ASA-201601-28] chromium: multiple issues
by Remi Gacogne 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-28 ========================================== Severity: Critical Date : 2016-01-25 CVE-ID : CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 48.0.2564.82-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 48.0.2564.82-1. # pacman -Syu "chromium>=48.0.2564.82-1" The problem has been fixed upstream in version 48.0.2564.82. Workaround ========== None. Description =========== - CVE-2016-1612: The LoadIC::UpdateCaches function in ic/ic.cc in Google V8 does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code. Credit to cloudfuzzer. - CVE-2016-1613: Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects. - CVE-2016-1614: The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink mishandles the initialization mode, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. Credit to Christoph Diehl. - CVE-2016-1615: The Omnibox implementation allows remote attackers to spoof a document's origin via unspecified vectors. Credit to Ron Masas. - CVE-2016-1616: The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc allows remote attackers to spoof URLs via vectors involving an unfocused custom button. Credit to Luan Herrera. - CVE-2016-1617: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. Credit to Yan Zhu. - CVE-2016-1618: Blink does not ensure that a proper cryptographicallyRandomValues random number generator is used, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors. Credit to Aaron Toponce. - CVE-2016-1619: Multiple integer overflows in the sycc422_to_rgb and sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document. Credit to Keve Nagy. - CVE-2016-1620: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker might be able to cause a denial of service, access sensitive information or execute arbitrary code on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/01/stable-channel-update_20.ht… https://access.redhat.com/security/cve/CVE-2016-1612 https://access.redhat.com/security/cve/CVE-2016-1613 https://access.redhat.com/security/cve/CVE-2016-1614 https://access.redhat.com/security/cve/CVE-2016-1615 https://access.redhat.com/security/cve/CVE-2016-1616 https://access.redhat.com/security/cve/CVE-2016-1617 https://access.redhat.com/security/cve/CVE-2016-1618 https://access.redhat.com/security/cve/CVE-2016-1619 https://access.redhat.com/security/cve/CVE-2016-1620

1 0

[arch-security] [ASA-201601-27] privoxy: denial of service
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-27 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2016-1982 CVE-2016-1983 Package : privoxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package privoxy before version 3.0.24-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.0.24-1. # pacman -Syu "privoxy>=3.0.24-1" The problems have been fixed upstream in version 3.0.24. Workaround ========== None. Description =========== - CVE-2016-1982 (denial of service) A vulnerability was discovered in a way the privoxy deals with corrupted chunk-encoded content. A maliciously crafted input can result in a remote denial of service. - CVE-2016-1983 (denial of service) A vulnerability was found in a way the privoxy processes specific client requests. A request with "Host" header empty could result in an invalid read. Impact ====== A remote attacker is able to craft special input that, when processed, is leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-1982 https://access.redhat.com/security/cve/CVE-2016-1983 http://seclists.org/oss-sec/2016/q1/179

1 0

[arch-security] [ASA-201601-26] linux-lts: privilege escalation
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-26 ========================================== Severity: Critical Date : 2016-01-25 CVE-ID : CVE-2016-0728 Package : linux-lts Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-lts before version 4.1.16-1 is vulnerable to local privilege escalation. Resolution ========== Upgrade to 4.1.16-1. # pacman -Syu "linux-lts>=4.1.16-1" The problem has been fixed upstream in version 4.1.16. Workaround ========== None. Description =========== It was reported that possible use-after-free vulnerability in keyring facility, possibly leading to local privilege escalation, was found. Function join_session_keyring in security/keys/process_keys.c holds a reference to the requested keyring, but if that keyring is the same as the one being currently used by the process, the kernel wouldn't decrease keyring->usage before returning to userspace. The usage field can be possibly overflowed causing use-after-free on the keyring object. Impact ====== A local attacker is able to make use of this vulnerability to elevate privileges and gain root access to the underlying system. References ========== https://access.redhat.com/security/cve/CVE-2016-0728 http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-… https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://bugs.archlinux.org/task/47820

1 0

[arch-security] [ASA-201601-25] ecryptfs-utils: privilege escalation
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-25 ========================================== Severity: Critical Date : 2016-01-25 CVE-ID : CVE-2016-1572 Package : ecryptfs-utils Type : privilege escalation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ecryptfs-utils before version 108-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 108-2. # pacman -Syu "ecryptfs-utils>=108-2" The problem has been fixed upstream and the patch has been applied. Workaround ========== None. Description =========== An unprivileged user can mount an ecryptfs over /proc/$pid because according to stat(), it is a normal directory and owned by the user. However, the user is not actually permitted to create arbitrary directory entries in /proc/$pid, and ecryptfs' behavior might be enabling privilege escalation attacks with the help of other programs that use procfs. Impact ====== A remote attacker is able to elevate the privileges and gain unauthorized root access. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1572 https://bugs.launchpad.net/ecryptfs/+bug/1530566 https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/870

1 0