August 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201608-12] linux: information disclosure
by Remi Gacogne 14 Aug '16

14 Aug '16

Arch Linux Security Advisory ASA-201608-12 ========================================== Severity: High Date : 2016-08-14 CVE-ID : CVE-2016-5696 Package : linux Type : information disclosure Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux before version 4.7-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.7-1. # pacman -Syu "linux>=4.7-1" The problem has been fixed upstream in version 4.7. Workaround ========== The challenge ACK rate limiting can be entirely disabled by setting net.ipv4.tcp_challenge_ack_limit to a very high value. This can be done by creating a new file in the /etc/sysctl.d/ directory containing the following line: net.ipv4.tcp_challenge_ack_limit = 999999999 then issuing the following command so that the new file is taken into account: # sysctl --system Please be aware that this workaround should be removed as soon as a patched kernel has been installed, as ACK rate limiting is a useful security feature. Description =========== A security issue has been found in the Linux kernel's implementation of challenge ACKs as specified in RFC 5961. An attacker which knows a connection's client IP, server IP and server port can abuse the challenge ACK mechanism to determine the accuracy of a normally 'blind' attack on the client or server. Successful exploitation of this flaw could allow a remote attacker to inject or control a TCP stream contents in a connection between a Linux device and its connected client/server. Impact ====== A remote attacker can detect, control and inject content into a TCP stream. References ========== http://seclists.org/oss-sec/2016/q3/44 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-5696

1 0

[arch-security] [ASA-201608-11] websvn: cross-site scripting
by Remi Gacogne 11 Aug '16

11 Aug '16

Arch Linux Security Advisory ASA-201608-11 ========================================== Severity: Medium Date : 2016-08-11 CVE-ID : CVE-2016-1236 Package : websvn Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package websvn before version 2.3.3-7 is vulnerable to several cross-site scripting issues. Resolution ========== Upgrade to 2.3.3-7. # pacman -Syu "websvn>=2.3.3-7" The problem has not been fixed upstream yet. Workaround ========== None. Description =========== Multiple cross-site scripting (XSS) vulnerabilities in revision.php, log.php, listing.php, and comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a file or directory in a repository. Impact ====== A remote attacker can execute arbitrary javascript code in the victim's browser by creating a file or a directory with a specially crafted name in a SVN repository. References ========== https://bugs.archlinux.org/task/50344 http://www.openwall.com/lists/oss-security/2016/05/05/22 https://access.redhat.com/security/cve/CVE-2016-1236

1 0

[arch-security] [ASA-201608-10] jq: arbitrary code execution
by Remi Gacogne 10 Aug '16

10 Aug '16

Arch Linux Security Advisory ASA-201608-10 ========================================== Severity: High Date : 2016-08-10 CVE-ID : CVE-2015-8863 Package : jq Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jq before version 1.5-4 is vulnerable to a heap-based buffer overflow leading to arbitrary code execution. Resolution ========== Upgrade to 1.5-4. # pacman -Syu "jq>=1.5-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-based buffer overflow has been found in jq when parsing a JSON-encoded number longer than 256 bytes. The NULL-terminator byte was not allocated when the buffer was resized, causing a off-by-one write. Impact ====== A remote attacker can execute arbitrary code on the affected host by tricking a victim into processing a specially crafted JSON file. References ========== https://bugs.archlinux.org/task/50330 http://seclists.org/oss-sec/2016/q2/134 https://access.redhat.com/security/cve/CVE-2015-8863

1 0

[arch-security] [ASA-201608-9] curl: multiple issues
by Remi Gacogne 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-9 ========================================= Severity: Medium Date : 2016-08-08 CVE-ID : CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 Package : curl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.50.1-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 7.50.1-1. # pacman -Syu "curl>=7.50.1-1" The problems have been fixed upstream in version 7.50.1. Workaround ========== None. Description =========== - CVE-2016-5419 (authentication bypass) libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). - CVE-2016-5420 (authentication bypass) libcurl supports reuse of established connections for subsequent requests. It does this by keeping a few previous connections "alive" in a connection pool so that a subsequent request that can use one of them instead of creating a new connection will do so. When using a client certificate for a connection that was then put into the connection pool, that connection could then wrongly get reused in a subsequent request to that same server that either didn't use a client certificate at all or that asked to use a different client certificate thus trying to tell the user that it is a different entity. This mistakenly using the wrong connection could of course lead to applications sending requests to the wrong realms of the server using authentication that it wasn't supposed to have for those operations. - CVE-2016-5421 (arbitrary code execution) libcurl works with easy handles using the type 'CURL *' that are objects the application creates using curl_easy_init(). They are the handles that are all each associated with a single transfer at a time. libcurl also has an internal struct that represents and holds most state that is related to a single connection. An easy handle can hold references to one or many such connection structs depending on the requested operations. When using libcurl's multi interface, an application performs transfers by adding one or more easy handles to the multi handle and then it can drive all those transfers in parallel. Due to a flaw, libcurl could leave a pointer to a freed connection struct dangling in an easy handle that was previously added to a multi handle when curl_multi_cleanup() is called with an easy handle still added to it. This does not seem to cause any notable harm if the handle is then closed properly. However, if the easy handle would instead get used again with the easy interface and curl_easy_perform() to do another transfer, it would blindly use the connection struct pointer now pointing to freed memory. An application could be made to allocate its own fake version of the connect struct, fill in some data and then have the curl_easy_perform() call do something that clearly was not intended by the original code. Impact ====== A remote attacker might be able to bypass TLS client certificate authentication by tricking an application using libcurl into reusing an existing TLS session. A local attacker might be able to execute arbitrary code on the affected host by tricking an application using libcurl into reusing an easy handle. References ========== https://curl.haxx.se/docs/adv_20160803A.html https://curl.haxx.se/docs/adv_20160803B.html https://curl.haxx.se/docs/adv_20160803C.html https://access.redhat.com/security/cve/CVE-2016-5419 https://access.redhat.com/security/cve/CVE-2016-5420 https://access.redhat.com/security/cve/CVE-2016-5421

1 0

[arch-security] [ASA-201608-8] libupnp: arbitrary filesystem access
by Levente Polyak 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-8 ========================================= Severity: Medium Date : 2016-08-08 CVE-ID : CVE-2016-6255 Package : libupnp Type : arbitrary filesystem access Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libupnp before version 1.6.20-1 is vulnerable to arbitrary filesystem access. Resolution ========== Upgrade to 1.6.20-1. # pacman -Syu "libupnp>=1.6.20-1" The problem has been fixed upstream in version 1.6.20. Workaround ========== None. Description =========== A vulnerability was found in libupnp. If there's no registered handler for a POST or GET request, the default behavior is to write to or read from the filesystem. This allows an unauthenticated attacker to store or retrieve arbitrary data. This issue allows full host filesystem access if the process is running as root and using / as the web root. Impact ====== A remote attacker is able to read from or write to arbitrary files on the host filesystem via GET and POST requests. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6255 http://www.openwall.com/lists/oss-security/2016/07/18/13

1 0

[arch-security] [ASA-201608-7] lib32-glibc: denial of service
by Levente Polyak 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-7 ========================================= Severity: Low Date : 2016-08-08 CVE-ID : CVE-2016-3075 CVE-2016-5417 Package : lib32-glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.24-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.24-1. # pacman -Syu "lib32-glibc>=2.24-1" The problems have been fixed upstream in version 2.24. Workaround ========== None. Description =========== - CVE-2016-3075 (denial of service) The getnetbyname implementation in nss_dns contains a potentially unbounded alloca call (in the form of a call to strdupa), leading to a stack overflow (stack exhaustion) and a crash if getnetbyname is invoked on a very long name. - CVE-2016-5417 (denial of service) The sockaddr_in6 allocated in resolv/res_init.c:317 is not freed, leaking 28 bytes per thread using the resolver (according to valgrind). The leak is triggered if name resolution functions are called in such a way that internal resolver data structures are only initialized partially. This issue may ultimately lead to denial of service by leaking extensive amounts of memory. Impact ====== A remote attacker is able to perform a denial of service attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-3075 https://access.redhat.com/security/cve/CVE-2016-5417 https://sourceware.org/bugzilla/show_bug.cgi?id=19879 https://sourceware.org/bugzilla/show_bug.cgi?id=19257

1 0

[arch-security] [ASA-201608-6] glibc: denial of service
by Levente Polyak 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-6 ========================================= Severity: Low Date : 2016-08-08 CVE-ID : CVE-2016-3075 CVE-2016-5417 Package : glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.24-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.24-1. # pacman -Syu "glibc>=2.24-1" The problems have been fixed upstream in version 2.24. Workaround ========== None. Description =========== - CVE-2016-3075 (denial of service) The getnetbyname implementation in nss_dns contains a potentially unbounded alloca call (in the form of a call to strdupa), leading to a stack overflow (stack exhaustion) and a crash if getnetbyname is invoked on a very long name. - CVE-2016-5417 (denial of service) The sockaddr_in6 allocated in resolv/res_init.c:317 is not freed, leaking 28 bytes per thread using the resolver (according to valgrind). The leak is triggered if name resolution functions are called in such a way that internal resolver data structures are only initialized partially. This issue may ultimately lead to denial of service by leaking extensive amounts of memory. Impact ====== A remote attacker is able to perform a denial of service attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-3075 https://access.redhat.com/security/cve/CVE-2016-5417 https://sourceware.org/bugzilla/show_bug.cgi?id=19879 https://sourceware.org/bugzilla/show_bug.cgi?id=19257

1 0

[arch-security] [ASA-201608-5] jre7-openjdk-headless: multiple issues
by Levente Polyak 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-5 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-3458 CVE-2016-3500 CVE-2016-3508 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Package : jre7-openjdk-headless Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk-headless before version 7.u111_2.6.7-1 is vulnerable to multiple issues including denial of service and sandbox restriction bypass. Resolution ========== Upgrade to 7.u111_2.6.7-1. # pacman -Syu "jre7-openjdk-headless>=7.u111_2.6.7-1" The problems have been fixed upstream in version 7.u111_2.6.7. Workaround ========== None. Description =========== - CVE-2016-3458 (sandbox restriction bypass) It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3500 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2016-3508 (denial of service) It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property. - CVE-2016-3550 (sandbox restriction bypass) Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3598 (sandbox restriction bypass) A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3606 (sandbox restriction bypass) It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3610 (sandbox restriction bypass) It was discovered that the filterReturnValue() method of the MethodHandles in the Libraries component of OpenJDK did not properly check filter MethodHandle parameter count. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker is able to perform a denial of service attack or bypass sandbox restrictions via various vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2016-July/036560.html https://access.redhat.com/security/cve/CVE-2016-3458 https://access.redhat.com/security/cve/CVE-2016-3500 https://access.redhat.com/security/cve/CVE-2016-3508 https://access.redhat.com/security/cve/CVE-2016-3550 https://access.redhat.com/security/cve/CVE-2016-3598 https://access.redhat.com/security/cve/CVE-2016-3606 https://access.redhat.com/security/cve/CVE-2016-3610

1 0

[arch-security] [ASA-201608-4] jre7-openjdk: multiple issues
by Levente Polyak 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-4 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-3458 CVE-2016-3500 CVE-2016-3508 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Package : jre7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u111_2.6.7-1 is vulnerable to multiple issues including denial of service and sandbox restriction bypass. Resolution ========== Upgrade to 7.u111_2.6.7-1. # pacman -Syu "jre7-openjdk>=7.u111_2.6.7-1" The problems have been fixed upstream in version 7.u111_2.6.7. Workaround ========== None. Description =========== - CVE-2016-3458 (sandbox restriction bypass) It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3500 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2016-3508 (denial of service) It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property. - CVE-2016-3550 (sandbox restriction bypass) Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3598 (sandbox restriction bypass) A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3606 (sandbox restriction bypass) It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3610 (sandbox restriction bypass) It was discovered that the filterReturnValue() method of the MethodHandles in the Libraries component of OpenJDK did not properly check filter MethodHandle parameter count. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker is able to perform a denial of service attack or bypass sandbox restrictions via various vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2016-July/036560.html https://access.redhat.com/security/cve/CVE-2016-3458 https://access.redhat.com/security/cve/CVE-2016-3500 https://access.redhat.com/security/cve/CVE-2016-3508 https://access.redhat.com/security/cve/CVE-2016-3550 https://access.redhat.com/security/cve/CVE-2016-3598 https://access.redhat.com/security/cve/CVE-2016-3606 https://access.redhat.com/security/cve/CVE-2016-3610

1 0

[arch-security] [ASA-201608-3] jdk7-openjdk: multiple issues
by Levente Polyak 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-3 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-3458 CVE-2016-3500 CVE-2016-3508 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Package : jdk7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk before version 7.u111_2.6.7-1 is vulnerable to multiple issues including denial of service and sandbox restriction bypass. Resolution ========== Upgrade to 7.u111_2.6.7-1. # pacman -Syu "jdk7-openjdk>=7.u111_2.6.7-1" The problems have been fixed upstream in version 7.u111_2.6.7. Workaround ========== None. Description =========== - CVE-2016-3458 (sandbox restriction bypass) It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3500 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2016-3508 (denial of service) It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property. - CVE-2016-3550 (sandbox restriction bypass) Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3598 (sandbox restriction bypass) A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3606 (sandbox restriction bypass) It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3610 (sandbox restriction bypass) It was discovered that the filterReturnValue() method of the MethodHandles in the Libraries component of OpenJDK did not properly check filter MethodHandle parameter count. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker is able to perform a denial of service attack or bypass sandbox restrictions via various vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2016-July/036560.html https://access.redhat.com/security/cve/CVE-2016-3458 https://access.redhat.com/security/cve/CVE-2016-3500 https://access.redhat.com/security/cve/CVE-2016-3508 https://access.redhat.com/security/cve/CVE-2016-3550 https://access.redhat.com/security/cve/CVE-2016-3598 https://access.redhat.com/security/cve/CVE-2016-3606 https://access.redhat.com/security/cve/CVE-2016-3610

1 0