October 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201710-14] wireshark-cli: denial of service
by Remi Gacogne 12 Oct '17

12 Oct '17

Arch Linux Security Advisory ASA-201710-14 ========================================== Severity: Medium Date : 2017-10-12 CVE-ID : CVE-2017-15189 CVE-2017-15190 CVE-2017-15191 CVE-2017-15192 CVE-2017-15193 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-440 Summary ======= The package wireshark-cli before version 2.4.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "wireshark-cli>=2.4.2-1" The problems have been fixed upstream in version 2.4.2. Workaround ========== None. Description =========== - CVE-2017-15189 (denial of service) An infinite loop flaw has been discovered in wireshark before 2.4.2 in the DOCSIS dissector leading to excessive consumption of CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-15190 (denial of service) A stack pointer use after scope flaw has been discovered in wireshark before 2.4.2 in the RTSP dissector leading to application crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-15191 (denial of service) A length check flaw has been discovered in wireshark before 2.4.2 in the BT ATT dissector when 7bit strings were decoded leading to application crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-15192 (denial of service) A flaw has been discovered in wireshark before 2.4.2 in the BT ATT dissector leading to application crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-15193 (denial of service) A flaw has been discovered in wireshark before 2.4.2 in the MBIM dissector when pre sizing wmem arrays leading to resource consumption and application crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker might be able to crash wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== http://seclists.org/wireshark/2017/Oct/27 https://www.wireshark.org/security/wnpa-sec-2017-46.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080 https://code.wireshark.org/review/#/c/23663/ https://www.wireshark.org/security/wnpa-sec-2017-45.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077 https://code.wireshark.org/review/#/c/23635/ https://www.wireshark.org/security/wnpa-sec-2017-44.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068 https://code.wireshark.org/review/#/c/23591/ https://www.wireshark.org/security/wnpa-sec-2017-42.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049 https://code.wireshark.org/review/#/c/23470/ https://www.wireshark.org/security/wnpa-sec-2017-43.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056 https://code.wireshark.org/review/#/c/23537/ https://security.archlinux.org/CVE-2017-15189 https://security.archlinux.org/CVE-2017-15190 https://security.archlinux.org/CVE-2017-15191 https://security.archlinux.org/CVE-2017-15192 https://security.archlinux.org/CVE-2017-15193

1 0

[arch-security] [ASA-201710-13] flyspray: cross-site scripting
by Levente Polyak 12 Oct '17

12 Oct '17

Arch Linux Security Advisory ASA-201710-13 ========================================== Severity: High Date : 2017-10-10 CVE-ID : CVE-2017-15213 CVE-2017-15214 Package : flyspray Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-439 Summary ======= The package flyspray before version 1.0rc6-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 1.0rc6-1. # pacman -Syu "flyspray>=1.0rc6-1" The problems have been fixed upstream in version 1.0rc6. Workaround ========== None. Description =========== - CVE-2017-15213 (cross-site scripting) A stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the real_name or email_address field in themes/CleanFS/templates/common.editallusers.tpl. - CVE-2017-15214 (cross-site scripting) A stored XSS vulnerability in Flyspray between 1.0-rc4 and 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users (including unauthenticated users), via the name, title, or id parameter of dokuwiki links in plugins/dokuwiki/lib/plugins/changelinks/syntax.php. Impact ====== A remote attacker is able to perform a cross-side scripting attack and possibly gain administrator privileges by injecting malicious javascript. References ========== http://www.openwall.com/lists/oss-security/2017/10/10/6 https://github.com/Flyspray/flyspray/commit/754ec5d04348ef7ecb8cb02ade976dc… https://github.com/Flyspray/flyspray/commit/00cfae5661124f9d67ac6733db61b2b… https://security.archlinux.org/CVE-2017-15213 https://security.archlinux.org/CVE-2017-15214

1 0

[arch-security] [ASA-201710-12] salt: multiple issues
by Santiago Torres-Arias 10 Oct '17

10 Oct '17

Arch Linux Security Advisory ASA-201710-12 ========================================== Severity: Medium Date : 2017-10-09 CVE-ID : CVE-2017-14695 CVE-2017-14696 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-438 Summary ======= The package salt before version 2017.7.2-1 is vulnerable to multiple issues including denial of service and directory traversal. Resolution ========== Upgrade to 2017.7.2-1. # pacman -Syu "salt>=2017.7.2-1" The problems have been fixed upstream in version 2017.7.2. Workaround ========== None. Description =========== - CVE-2017-14695 (directory traversal) It has been discovered that maliciously crafted minion IDs can cause unwanted directory traversals on the salt-master. The flaw is within the minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing path seperators that will cause a directory traversal. - CVE-2017-14696 (denial of service) It has been discovered that salt incorrectly handled IDs with null bytes in decoded payloads. A specially crafted authentication request will crash the application while processing. Impact ====== An unauthenticated attacker is able to craft a malicious minion ID to cause a directory traversal on the salt-master or send a specially crafted authentication request to crash the application. References ========== https://groups.google.com/forum/#!topic/salt-announce/X8ZiQrZLujA https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28… https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a… https://security.archlinux.org/CVE-2017-14695 https://security.archlinux.org/CVE-2017-14696

1 0

[arch-security] [ASA-201710-11] lame: denial of service
by Levente Polyak 10 Oct '17

10 Oct '17

Arch Linux Security Advisory ASA-201710-11 ========================================== Severity: Low Date : 2017-10-09 CVE-ID : CVE-2017-15018 Package : lame Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-437 Summary ======= The package lame before version 3.99.5-4 is vulnerable to denial of service. Resolution ========== Upgrade to 3.99.5-4. # pacman -Syu "lame>=3.99.5-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-based buffer over-read vulnerability has been discovered in LAME 3.99.5 in the k_34_4 function in vbrquantize.c while handling a malformed file. Impact ====== An attacker is able to crash the application by tricking the user into processing a specially crafted file. References ========== https://bugs.archlinux.org/task/55889 https://sourceforge.net/p/lame/bugs/480/ https://security.archlinux.org/CVE-2017-15018

1 0

[arch-security] [ASA-201710-10] xorg-server: multiple issues
by Levente Polyak 10 Oct '17

10 Oct '17

Arch Linux Security Advisory ASA-201710-10 ========================================== Severity: Medium Date : 2017-10-08 CVE-ID : CVE-2017-13721 CVE-2017-13723 Package : xorg-server Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-432 Summary ======= The package xorg-server before version 1.19.4-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.19.4-1. # pacman -Syu "xorg-server>=1.19.4-1" The problems have been fixed upstream in version 1.19.4. Workaround ========== None. Description =========== - CVE-2017-13721 (denial of service) A denial of service vulnerability was found in xorg-server in the ProcShmCreateSegment function due to a missing shmseg resource ids validation. A passed shmseg resource id may belong to a non-existing client and abort X server with FatalError "client not in use", or overwrite existing segment of another existing client. - CVE-2017-13723 (arbitrary code execution) A stack buffer overflow was found in xkbtext.c, which didn't handle xkb formatted string output safely due to a single shared static buffer. The fix introduces a ring of resizable buffers to avoid problems when strings end up longer than anticipated. This vulnerability may potentially lead to privilege escalation when the xorg-server is running with root privileges. Impact ====== A local attacker is able to crash the xorg-server process leading to denial of service or possibly elevate privileges when the xorg-server is running with root privileges. References ========== https://lists.x.org/archives/xorg-announce/2017-October/002808.html https://cgit.freedesktop.org/xorg/xserver/commit/?id=b95f25af141d33a65f6f82… https://cgit.freedesktop.org/xorg/xserver/commit/?id=94f11ca5cf011ef123bd22… https://security.archlinux.org/CVE-2017-13721 https://security.archlinux.org/CVE-2017-13723

1 0

[arch-security] [ASA-201710-9] lib32-krb5: arbitrary code execution
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-9 ========================================= Severity: High Date : 2017-10-05 CVE-ID : CVE-2017-11462 Package : lib32-krb5 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-415 Summary ======= The package lib32-krb5 before version 1.15.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.15.2-1. # pacman -Syu "lib32-krb5>=1.15.2-1" The problem has been fixed upstream in version 1.15.2. Workaround ========== None. Description =========== A double free vulnerability has been discovered in MIT Kerberos 5 (aka krb5) allowing attackers to crash the application or possibly execute arbitrary code via vectors involving automatic deletion of security contexts on error. Impact ====== A remote attacker is able to crash the application or possibly execute arbitrary code on the affected host. References ========== https://web.mit.edu/kerberos/krb5-1.15/ http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598 https://bugzilla.redhat.com/show_bug.cgi?id=1488873 https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf https://security.archlinux.org/CVE-2017-11462

1 0

[arch-security] [ASA-201710-8] krb5: multiple issues
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-8 ========================================= Severity: High Date : 2017-10-05 CVE-ID : CVE-2017-11368 CVE-2017-11462 Package : krb5 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-414 Summary ======= The package krb5 before version 1.15.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.15.2-1. # pacman -Syu "krb5>=1.15.2-1" The problems have been fixed upstream in version 1.15.2. Workaround ========== None. Description =========== - CVE-2017-11368 (denial of service) A denial of service flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request. - CVE-2017-11462 (arbitrary code execution) A double free vulnerability has been discovered in MIT Kerberos 5 (aka krb5) allowing attackers to crash the application or possibly execute arbitrary code via vectors involving automatic deletion of security contexts on error. Impact ====== A remote attacker is able to crash the application or possibly execute arbitrary code on the affected host. References ========== https://web.mit.edu/kerberos/krb5-1.15/ https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970 http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598 https://bugzilla.redhat.com/show_bug.cgi?id=1488873 https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf https://security.archlinux.org/CVE-2017-11368 https://security.archlinux.org/CVE-2017-11462

1 0

[arch-security] [ASA-201710-7] libcurl-compat: multiple issues
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-7 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-389 Summary ======= The package libcurl-compat before version 7.56.0-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 7.56.0-1. # pacman -Syu "libcurl-compat>=7.56.0-1" The problems have been fixed upstream in version 7.56.0. Workaround ========== None. Description =========== - CVE-2017-1000099 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. - CVE-2017-1000100 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. - CVE-2017-1000254 (denial of service) When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. Impact ====== An attacker is able to read sensitive information by asking curl to retrieve a maliciously crafted URL. Furthermore a malicious server can cause libcurl to segfault when connecting via FTP leading to denial of service. References ========== https://curl.haxx.se/docs/adv_20170809C.html https://curl.haxx.se/CVE-2017-1000099.patch https://curl.haxx.se/docs/adv_20170809B.html https://curl.haxx.se/CVE-2017-1000100.patch https://curl.haxx.se/docs/adv_20171004.html https://curl.haxx.se/CVE-2017-1000254.patch https://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584 https://security.archlinux.org/CVE-2017-1000099 https://security.archlinux.org/CVE-2017-1000100 https://security.archlinux.org/CVE-2017-1000254

1 0

[arch-security] [ASA-201710-6] lib32-libcurl-compat: multiple issues
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-6 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-388 Summary ======= The package lib32-libcurl-compat before version 7.56.0-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 7.56.0-1. # pacman -Syu "lib32-libcurl-compat>=7.56.0-1" The problems have been fixed upstream in version 7.56.0. Workaround ========== None. Description =========== - CVE-2017-1000099 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. - CVE-2017-1000100 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. - CVE-2017-1000254 (denial of service) When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. Impact ====== An attacker is able to read sensitive information by asking curl to retrieve a maliciously crafted URL. Furthermore a malicious server can cause libcurl to segfault when connecting via FTP leading to denial of service. References ========== https://curl.haxx.se/docs/adv_20170809C.html https://curl.haxx.se/CVE-2017-1000099.patch https://curl.haxx.se/docs/adv_20170809B.html https://curl.haxx.se/CVE-2017-1000100.patch https://curl.haxx.se/docs/adv_20171004.html https://curl.haxx.se/CVE-2017-1000254.patch https://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584 https://security.archlinux.org/CVE-2017-1000099 https://security.archlinux.org/CVE-2017-1000100 https://security.archlinux.org/CVE-2017-1000254

1 0

[arch-security] [ASA-201710-5] libcurl-gnutls: multiple issues
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-5 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-387 Summary ======= The package libcurl-gnutls before version 7.56.0-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 7.56.0-1. # pacman -Syu "libcurl-gnutls>=7.56.0-1" The problems have been fixed upstream in version 7.56.0. Workaround ========== None. Description =========== - CVE-2017-1000099 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. - CVE-2017-1000100 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. - CVE-2017-1000254 (denial of service) When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. Impact ====== An attacker is able to read sensitive information by asking curl to retrieve a maliciously crafted URL. Furthermore a malicious server can cause libcurl to segfault when connecting via FTP leading to denial of service. References ========== https://curl.haxx.se/docs/adv_20170809C.html https://curl.haxx.se/CVE-2017-1000099.patch https://curl.haxx.se/docs/adv_20170809B.html https://curl.haxx.se/CVE-2017-1000100.patch https://curl.haxx.se/docs/adv_20171004.html https://curl.haxx.se/CVE-2017-1000254.patch https://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584 https://security.archlinux.org/CVE-2017-1000099 https://security.archlinux.org/CVE-2017-1000100 https://security.archlinux.org/CVE-2017-1000254

1 0