January 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201701-30] powerdns-recursor: multiple issues
by Levente Polyak 20 Jan '17

20 Jan '17

Arch Linux Security Advisory ASA-201701-30 ========================================== Severity: Medium Date : 2017-01-19 CVE-ID : CVE-2016-7068 CVE-2016-7073 CVE-2016-7074 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-148 Summary ======= The package powerdns-recursor before version 4.0.4-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 4.0.4-1. # pacman -Syu "powerdns-recursor>=4.0.4-1" The problems have been fixed upstream in version 4.0.4. Workaround ========== None. Description =========== - CVE-2016-7068 (denial of service) An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. - CVE-2016-7073 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values in AXFRRetriever, leading to a possible replay attack. - CVE-2016-7074 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature. Impact ====== A remote attacker is able to perform a denial of service attack or bypass certain verification possibly leading to a replay attack. References ========== http://seclists.org/oss-sec/2017/q1/97 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ https://security.archlinux.org/CVE-2016-7068 https://security.archlinux.org/CVE-2016-7073 https://security.archlinux.org/CVE-2016-7074

1 0

[arch-security] [ASA-201701-29] powerdns: multiple issues
by Levente Polyak 20 Jan '17

20 Jan '17

Arch Linux Security Advisory ASA-201701-29 ========================================== Severity: Medium Date : 2017-01-19 CVE-ID : CVE-2016-2120 CVE-2016-7068 CVE-2016-7072 CVE-2016-7073 CVE-2016-7074 Package : powerdns Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-147 Summary ======= The package powerdns before version 4.0.2-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 4.0.2-1. # pacman -Syu "powerdns>=4.0.2-1" The problems have been fixed upstream in version 4.0.2. Workaround ========== None. Description =========== - CVE-2016-2120 (denial of service) An issue has been found in PowerDNS Authoritative Server allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary. - CVE-2016-7068 (denial of service) An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. - CVE-2016-7072 (denial of service) An issue has been found in PowerDNS Authoritative Server allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible. - CVE-2016-7073 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values in AXFRRetriever, leading to a possible replay attack. - CVE-2016-7074 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature. Impact ====== A remote attacker is able to perform a denial of service attack or bypass certain verification possibly leading to a replay attack. References ========== http://seclists.org/oss-sec/2017/q1/97 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/ https://security.archlinux.org/CVE-2016-2120 https://security.archlinux.org/CVE-2016-7068 https://security.archlinux.org/CVE-2016-7072 https://security.archlinux.org/CVE-2016-7073 https://security.archlinux.org/CVE-2016-7074

1 0

[arch-security] [ASA-201701-28] php: multiple issues
by Santiago Torres-Arias 19 Jan '17

19 Jan '17

Arch Linux Security Advisory ASA-201701-28 ========================================== Severity: High Date : 2017-01-19 CVE-ID : CVE-2016-9935 CVE-2016-9936 CVE-2017-5340 Package : php Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-105 Summary ======= The package php before version 7.1.1-0 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.1.1-0. # pacman -Syu "php>=7.1.1-0" The problems have been fixed upstream in version 7.1.1. Workaround ========== None. Description =========== - CVE-2016-9935 (denial of service) The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document. - CVE-2016-9936 (arbitrary code execution) The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after- free) or possibly execute arbitrary code via crafted serialized data. - CVE-2017-5340 (arbitrary code execution) It was found that PHP uses uninitialized memory during calls to `unserialize()`. The payload supplied to `unserialize()` may control this uninitialized memory region and thus may be used to trick PHP into operating on faked objects and calling attacker controlled destructor function pointers, effectively allowing arbitrary code execution via specially crafted serialized data. Impact ====== A remote attacker is able to use specially crafted input to perform a denial of service attack or execute arbitrary code on the affected host. References ========== http://www.openwall.com/lists/oss-security/2016/12/12/2 https://bugs.php.net/bug.php?id=73631 https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b48504… http://seclists.org/oss-sec/2016/q4/658 https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372… https://bugs.php.net/bug.php?id=72978 https://bugs.php.net/bug.php?id=73832 https://security.archlinux.org/CVE-2016-9935 https://security.archlinux.org/CVE-2016-9936 https://security.archlinux.org/CVE-2017-5340

1 0

[arch-security] [ASA-201701-27] webkit2gtk: multiple issues
by Remi Gacogne 18 Jan '17

18 Jan '17

Arch Linux Security Advisory ASA-201701-27 ========================================== Severity: Critical Date : 2017-01-18 CVE-ID : CVE-2016-7586 CVE-2016-7589 CVE-2016-7592 CVE-2016-7599 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-146 Summary ======= The package webkit2gtk before version 2.14.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.14.3-1. # pacman -Syu "webkit2gtk>=2.14.3-1" The problems have been fixed upstream in version 2.14.3. Workaround ========== None. Description =========== - CVE-2016-7586 (information disclosure) A validation issue was found in WebKitGTK+ < 2.14.3, leading to the potential disclosure of user information while processing maliciously crafted web content. The issue was fixed through improved state management. - CVE-2016-7589 (arbitrary code execution) A memory corruption issue was found in WebKitGTK+ < 2.14.3, leading to potential arbitrary code execution while processing maliciously crafted web content. The issue was fixed through improved state management. - CVE-2016-7592 (information disclosure) An issue in the handling of JavaScript prompts was found in WebKitGTK+ < 2.14.3, leading to potential compromise of user information while processing maliciously crafted web content. The issue was fixed through improved state management. - CVE-2016-7599 (information disclosure) An issue in the handling of HTTP redirects was found in WebKitGTK+ < 2.14.3, leading to potential disclosure of user information while processing maliciously crafted web content. This issue was addressed through improved cross origin validation. - CVE-2016-7623 (information disclosure) An issue in the handling of blob URLs was found in WebKitGTK+ < 2.14.3, leading to potential compromise of user information while processing maliciously crafted web content. This issue was addressed through improved URL handling. - CVE-2016-7632 (arbitrary code execution) A memory corruption issue was found in WebKitGTK+ < 2.14.3, leading to denial of service or arbitrary code execution while processing maliciously crafted web content. This issue was addressed through improved state management. - CVE-2016-7635 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved memory handling. - CVE-2016-7639 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7641 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7645 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7652 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved memory handling. - CVE-2016-7654 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7656 (arbitrary code execution) A memory corruption issue was found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issue was addressed through improved state management. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host via a maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2017-0001.html https://security.archlinux.org/CVE-2016-7586 https://security.archlinux.org/CVE-2016-7589 https://security.archlinux.org/CVE-2016-7592 https://security.archlinux.org/CVE-2016-7599 https://security.archlinux.org/CVE-2016-7623 https://security.archlinux.org/CVE-2016-7632 https://security.archlinux.org/CVE-2016-7635 https://security.archlinux.org/CVE-2016-7639 https://security.archlinux.org/CVE-2016-7641 https://security.archlinux.org/CVE-2016-7645 https://security.archlinux.org/CVE-2016-7652 https://security.archlinux.org/CVE-2016-7654 https://security.archlinux.org/CVE-2016-7656

1 0

[arch-security] [ASA-201701-26] python-crypto: arbitrary code execution
by Levente Polyak 16 Jan '17

16 Jan '17

Arch Linux Security Advisory ASA-201701-26 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python-crypto Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-118 Summary ======= The package python-crypto before version 2.6.1-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.6.1-5. # pacman -Syu "python-crypto>=2.6.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. Impact ====== A remote attacker is able to execute arbitrary code by passing certain parameters to the AES module. References ========== https://github.com/dlitz/pycrypto/issues/176 https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf… http://seclists.org/oss-sec/2016/q4/760 https://security.archlinux.org/CVE-2013-7459

1 0

[arch-security] [ASA-201701-25] python2-crypto: arbitrary code execution
by Levente Polyak 16 Jan '17

16 Jan '17

Arch Linux Security Advisory ASA-201701-25 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python2-crypto Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-118 Summary ======= The package python2-crypto before version 2.6.1-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.6.1-5. # pacman -Syu "python2-crypto>=2.6.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. Impact ====== A remote attacker is able to execute arbitrary code by passing certain parameters to the AES module. References ========== https://github.com/dlitz/pycrypto/issues/176 https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf… http://seclists.org/oss-sec/2016/q4/760 https://security.archlinux.org/CVE-2013-7459

1 0

[arch-security] [ASA-201701-24] nginx-mainline: privilege escalation
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-24 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-1247 Package : nginx-mainline Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-139 Summary ======= The package nginx-mainline before version 1.11.8-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.11.8-2. # pacman -Syu "nginx-mainline>=1.11.8-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A symlink attack vulnerability was discovered in nginx. An attacker who could already run commands under the nginx user id could use this access to append data to files owned by root, potentially elevating their own privileges to root. Impact ====== A remote attacker who managed to compromise a web application is able to obtain root privileges on the affected host. References ========== https://bugs.archlinux.org/task/52547 https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016… https://security.archlinux.org/CVE-2016-1247

1 0

[arch-security] [ASA-201701-23] nginx: privilege escalation
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-23 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-1247 Package : nginx Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-138 Summary ======= The package nginx before version 1.10.2-3 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.10.2-3. # pacman -Syu "nginx>=1.10.2-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A symlink attack vulnerability was discovered in nginx. An attacker who could already run commands under the nginx user id could use this access to append data to files owned by root, potentially elevating their own privileges to root. Impact ====== A remote attacker who managed to compromise a web application is able to obtain root privileges on the affected host. References ========== https://bugs.archlinux.org/task/52546 https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016… https://security.archlinux.org/CVE-2016-1247

1 0

[arch-security] [ASA-201701-22] wordpress: multiple issues
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-22 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-10033 CVE-2016-10045 CVE-2017-5487 CVE-2017-5488 CVE-2017-5489 CVE-2017-5490 CVE-2017-5491 CVE-2017-5492 CVE-2017-5493 Package : wordpress Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-142 Summary ======= The package wordpress before version 4.7.1-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, access restriction bypass, cross-site request forgery and insufficient validation. Resolution ========== Upgrade to 4.7.1-1. # pacman -Syu "wordpress>=4.7.1-1" The problems have been fixed upstream in version 4.7.1. Workaround ========== None. Description =========== - CVE-2016-10033 (arbitrary code execution) A vulnerability has been discovered in PHPMailer that could potentially be used by unauthenticated remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application. This issue can be triggered by passing a maliciously crafted expression to the vulnerable application. - CVE-2016-10045 (arbitrary code execution) It has been discovered that the first patch of the vulnerability CVE-2016-10033 in PHPMailer was incomplete and could potentially still be used by unauthenticated remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application. This issue can be triggered by passing a maliciously crafted expression to the vulnerable application. - CVE-2017-5487 (access restriction bypass) A vulnerability has been discovered in wordpress exposing user data for all users who had authored a post of a public post type via the REST API. wordpress 4.7.1 limits this to only post types which have specified that they should be shown within the REST API. - CVE-2017-5488 (cross-site scripting) A cross-site scripting (XSS) vulnerability has been discovered in wordpress via the plugin name or version header on update-core.php. - CVE-2017-5489 (cross-site request forgery) A cross-site request forgery (CSRF) bypass has been discovered in wordpress via uploading a Flash file. - CVE-2017-5490 (cross-site scripting) A cross-site scripting (XSS) vulnerability has been discovered in wordpress via theme name fallback. - CVE-2017-5491 (access restriction bypass) A vulnerability has been discovered in wordpress allowing to post via email as it checks for mail.example.com if default settings aren't changed. - CVE-2017-5492 (cross-site request forgery) A cross-site request forgery (CSRF) vulnerability has been discovered in wordpress in the accessibility mode of widget editing. - CVE-2017-5493 (insufficient validation) An insufficient validation vulnerability has been discovered in wordpress leading to weak cryptographic security for multisite activation key. Impact ====== A remote attacker is able to perform a cross-site scripting or cross- site request forgery attack or possibly execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/52555 https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance… http://seclists.org/oss-sec/2017/q1/95 https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-… https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-… https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebb… https://github.com/WordPress/WordPress/commit/c9ea1de1441bb3bda133bf72d513c… https://github.com/WordPress/WordPress/commit/ce7fb2934dd111e6353784852de8a… https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df2… https://github.com/WordPress/WordPress/commit/03e5c0314aeffe6b27f4b98fef842… https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d… https://security.archlinux.org/CVE-2016-10033 https://security.archlinux.org/CVE-2016-10045 https://security.archlinux.org/CVE-2017-5487 https://security.archlinux.org/CVE-2017-5488 https://security.archlinux.org/CVE-2017-5489 https://security.archlinux.org/CVE-2017-5490 https://security.archlinux.org/CVE-2017-5491 https://security.archlinux.org/CVE-2017-5492 https://security.archlinux.org/CVE-2017-5493

1 0

[arch-security] [ASA-201701-21] libgit2: multiple issues
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-21 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-10128 CVE-2016-10129 CVE-2016-10130 Package : libgit2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-131 Summary ======= The package libgit2 before version 1:0.24.6-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation and denial of service. Resolution ========== Upgrade to 1:0.24.6-1. # pacman -Syu "libgit2>=1:0.24.6-1" The problems have been fixed upstream in version 0.24.6. Workaround ========== None. Description =========== - CVE-2016-10128 (arbitrary code execution) Each packet line in the Git protocol is prefixed by a four-byte length of how much data will follow, which we parse in `git_pkt_parse_line`. The transmitted length can either be equal to zero in case of a flush packet or has to be at least of length four, as it also includes the encoded length itself. Not checking this may result in a buffer overflow as it directly passes the length to functions which accept a `size_t` length as parameter. The issue is fixed by verifying that non-flush packets have at least a length of `PKT_LEN_SIZE`. - CVE-2016-10129 (denial of service) The Git protocol does not specify what should happen in the case of an empty packet line (that is a packet line "0004"). currently it indicates success, but does not return a packet in the case where an empty line is hit. The smart protocol was not prepared to handle such packets in all cases, though, resulting in a `NULL` pointer dereference. The issue is fixed by returning an error instead. - CVE-2016-10130 (insufficient validation) An issue has been discovered when checking certificate validity before clobbering the error variable. A valid parameter is provided to indicate whether the native cryptographic library considered the certificate to be correct. This parameter is always 1/true before the fix leading to a possible man-in-the-middle (MITM). Impact ====== A remote attacker is able to perform a man-in-the-middle attack, crash the application or possibly execute arbitrary code on the affected host. References ========== http://www.openwall.com/lists/oss-security/2017/01/11/6 https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d… https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75… https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb… https://security.archlinux.org/CVE-2016-10128 https://security.archlinux.org/CVE-2016-10129 https://security.archlinux.org/CVE-2016-10130

1 0