February 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201602-5] nettle: improper cryptographic calculations
by Levente Polyak 03 Feb '16

03 Feb '16

Arch Linux Security Advisory ASA-201602-5 ========================================= Severity: Medium Date : 2016-02-03 CVE-ID : CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 Package : nettle Type : improper cryptographic calculations Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nettle before version 3.2-1 is vulnerable to improper cryptographic calculations with unspecified impact. Resolution ========== Upgrade to 3.2-1. # pacman -Syu "nettle>=3.2-1" The problems have been fixed upstream in version 3.2-1. Workaround ========== None. Description =========== - CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 (improper cryptographic calculations) It has been discovered that multiple carry propagation bugs are producing wrong results in calculations. They affect the NIST P-256 and P-384 curves. The P-256 bug is in the C code and affects multiple architectures. The P-384 bug is in the assembly code and only affects 64 bit x86. The computation compiles a certain curve point with 1, which should not change the coordinates, however it does. Impact ====== The impact is currently unclear, but miscalculations in cryptographic functions are classified as security issues. References ========== https://access.redhat.com/security/cve/CVE-2015-8803 https://access.redhat.com/security/cve/CVE-2015-8804 https://access.redhat.com/security/cve/CVE-2015-8805 https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scala… https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html

1 0

[arch-security] [ASA-201602-4] lib32-curl: authentication bypass
by Levente Polyak 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-4 ========================================= Severity: Low Date : 2016-02-02 CVE-ID : CVE-2016-0755 Package : lib32-curl Type : authentication bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-curl before version 7.47.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 7.47.0-1. # pacman -Syu "lib32-curl>=7.47.0-1" The problem has been fixed upstream in version 7.47.0. Workaround ========== None. Description =========== A vulnerability was found in a way libcurl uses NTLM-authenticated proxy connections. Libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. Since NTLM-based authentication is connection oriented instead of request oriented as other HTTP based authentication, it is important that only connections that have been authenticated with the correct username + password are reused. This was done properly for server connections already, but libcurl failed to do it properly for proxy connections using NTLM, which might allow remote attackers to authenticate as other users via a request. Impact ====== A remote attacker is able to authenticate as other users via a request without providing any NTLM credentials. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0755 http://curl.haxx.se/docs/adv_20160127A.html

1 0

[arch-security] [ASA-201602-3] curl: authentication bypass
by Levente Polyak 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-3 ========================================= Severity: Low Date : 2016-02-02 CVE-ID : CVE-2016-0755 Package : curl Type : authentication bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.47.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 7.47.0-1. # pacman -Syu "curl>=7.47.0-1" The problem has been fixed upstream in version 7.47.0. Workaround ========== None. Description =========== A vulnerability was found in a way libcurl uses NTLM-authenticated proxy connections. Libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. Since NTLM-based authentication is connection oriented instead of request oriented as other HTTP based authentication, it is important that only connections that have been authenticated with the correct username + password are reused. This was done properly for server connections already, but libcurl failed to do it properly for proxy connections using NTLM, which might allow remote attackers to authenticate as other users via a request. Impact ====== A remote attacker is able to authenticate as other users via a request without providing any NTLM credentials. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0755 http://curl.haxx.se/docs/adv_20160127A.html

1 0

[arch-security] [ASA-201602-2] python2-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-2 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python2-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python2-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201602-1] python2-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-1 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python2-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python2-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201602-1] python-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-1 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0