October 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201710-4] lib32-libcurl-gnutls: multiple issues
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-4 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-386 Summary ======= The package lib32-libcurl-gnutls before version 7.56.0-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 7.56.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.56.0-1" The problems have been fixed upstream in version 7.56.0. Workaround ========== None. Description =========== - CVE-2017-1000099 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. - CVE-2017-1000100 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. - CVE-2017-1000254 (denial of service) When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. Impact ====== An attacker is able to read sensitive information by asking curl to retrieve a maliciously crafted URL. Furthermore a malicious server can cause libcurl to segfault when connecting via FTP leading to denial of service. References ========== https://curl.haxx.se/docs/adv_20170809C.html https://curl.haxx.se/CVE-2017-1000099.patch https://curl.haxx.se/docs/adv_20170809B.html https://curl.haxx.se/CVE-2017-1000100.patch https://curl.haxx.se/docs/adv_20171004.html https://curl.haxx.se/CVE-2017-1000254.patch https://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584 https://security.archlinux.org/CVE-2017-1000099 https://security.archlinux.org/CVE-2017-1000100 https://security.archlinux.org/CVE-2017-1000254

1 0

[arch-security] [ASA-201710-3] lib32-curl: multiple issues
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-3 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-371 Summary ======= The package lib32-curl before version 7.56.0-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 7.56.0-1. # pacman -Syu "lib32-curl>=7.56.0-1" The problems have been fixed upstream in version 7.56.0. Workaround ========== None. Description =========== - CVE-2017-1000099 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. - CVE-2017-1000100 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. - CVE-2017-1000254 (denial of service) When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. Impact ====== An attacker is able to read sensitive information by asking curl to retrieve a maliciously crafted URL. Furthermore a malicious server can cause libcurl to segfault when connecting via FTP leading to denial of service. References ========== https://curl.haxx.se/docs/adv_20170809C.html https://curl.haxx.se/CVE-2017-1000099.patch https://curl.haxx.se/docs/adv_20170809B.html https://curl.haxx.se/CVE-2017-1000100.patch https://curl.haxx.se/docs/adv_20171004.html https://curl.haxx.se/CVE-2017-1000254.patch https://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584 https://security.archlinux.org/CVE-2017-1000099 https://security.archlinux.org/CVE-2017-1000100 https://security.archlinux.org/CVE-2017-1000254

1 0

[arch-security] [ASA-201710-2] curl: denial of service
by Levente Polyak 06 Oct '17

06 Oct '17

Arch Linux Security Advisory ASA-201710-2 ========================================= Severity: Low Date : 2017-10-05 CVE-ID : CVE-2017-1000254 Package : curl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-422 Summary ======= The package curl before version 7.56.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 7.56.0-1. # pacman -Syu "curl>=7.56.0-1" The problem has been fixed upstream in version 7.56.0. Workaround ========== None. Description =========== When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. Impact ====== A malicious server can cause libcurl to segfault when connecting via FTP leading to denial of service. References ========== https://curl.haxx.se/docs/adv_20171004.html https://curl.haxx.se/CVE-2017-1000254.patch https://github.com/curl/curl/commit/5ff2c5ff25750aba1a8f64fbcad8e5b891512584 https://security.archlinux.org/CVE-2017-1000254

1 0

[arch-security] [ASA-201710-1] dnsmasq: multiple issues
by Levente Polyak 02 Oct '17

02 Oct '17

Arch Linux Security Advisory ASA-201710-1 ========================================= Severity: Critical Date : 2017-10-02 CVE-ID : CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 Package : dnsmasq Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-421 Summary ======= The package dnsmasq before version 2.78-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 2.78-1. # pacman -Syu "dnsmasq>=2.78-1" The problems have been fixed upstream in version 2.78. Workaround ========== None. Description =========== - CVE-2017-14491 (arbitrary code execution) A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. - CVE-2017-14492 (arbitrary code execution) A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless. - CVE-2017-14493 (arbitrary code execution) A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code. - CVE-2017-14494 (information disclosure) An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data. - CVE-2017-14495 (denial of service) A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add- subnet. - CVE-2017-14496 (denial of service) An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add- subnet. Impact ====== A remote attacker is able to execute arbitrary code, disclose sensitive information or crash the application by sending specially crafted packets. References ========== https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.h… https://github.com/google/security-research-pocs/tree/master/vulnerabilitie… http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=0549c73b7ea6b… http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=62cb936cb7ad5… http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=24036ea507862… http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=3d4ff1ba84195… http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=33e3f1029c9ec… http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=51eadb692a512… http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=897c113fda088… https://security.archlinux.org/CVE-2017-14491 https://security.archlinux.org/CVE-2017-14492 https://security.archlinux.org/CVE-2017-14493 https://security.archlinux.org/CVE-2017-14494 https://security.archlinux.org/CVE-2017-14495 https://security.archlinux.org/CVE-2017-14496

1 0