December 2017 - Arch-security - lists.archlinux.org

[ASA-201712-11] lib32-openssl-1.0: multiple issues
by Jelle van der Waa 17 Dec '17

17 Dec '17

Arch Linux Security Advisory ASA-201712-11 ========================================== Severity: Medium Date : 2017-12-17 CVE-ID : CVE-2017-3735 CVE-2017-3736 CVE-2017-3737 CVE-2017-3738 Package : lib32-openssl-1.0 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-480 Summary ======= The package lib32-openssl-1.0 before version 1.0.2.n-1 is vulnerable to multiple issues including information disclosure, private key recovery and denial of service. Resolution ========== Upgrade to 1.0.2.n-1. # pacman -Syu "lib32-openssl-1.0>=1.0.2.n-1" The problems have been fixed upstream in version 1.0.2.n. Workaround ========== None. Description =========== - CVE-2017-3735 (denial of service) A security issue has been found in OpenSSL < 1.1.0g. If an X.509 certificate has a malformed IPAddressFamily extension, OpenSSL could do a one-byte buffer overread. The most likely result would be an erroneous display of the certificate in text format. - CVE-2017-3736 (information disclosure) A carry propagation bug has been found in OpenSSL < 1.1.0g in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. - CVE-2017-3737 (information disclosure) OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. - CVE-2017-3738 (private key recovery) There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. Impact ====== A remote attacker can cause a denial of service via a crafted X.509 certificate. Furthermore a remote attacker with online access to an unpatched system on a vulnerable architecture can access sensitive information like a private key. References ========== https://www.openssl.org/news/vulnerabilities.html#2017-3735 https://www.openssl.org/news/secadv/20170828.txt https://github.com/openssl/openssl/commit/b23171744b01e473ebbfd6edad70c1c38… https://www.openssl.org/news/vulnerabilities.html#2017-3736 https://www.openssl.org/news/secadv/20171102.txt https://github.com/openssl/openssl/commit/668a709a8d7ea374ee72ad2d43ac72ec6… https://www.openssl.org/news/vulnerabilities.html#2017-3737 https://www.openssl.org/news/secadv/20171207.txt https://github.com/openssl/openssl/commit/898fb884b706aaeb283de4812340bb0bd… https://www.openssl.org/news/vulnerabilities.html#2017-3738 https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f… https://security.archlinux.org/CVE-2017-3735 https://security.archlinux.org/CVE-2017-3736 https://security.archlinux.org/CVE-2017-3737 https://security.archlinux.org/CVE-2017-3738

1 0

[ASA-201712-10] tor: multiple issues
by Remi Gacogne 16 Dec '17

16 Dec '17

Arch Linux Security Advisory ASA-201712-10 ========================================== Severity: High Date : 2017-12-16 CVE-ID : CVE-2017-8819 CVE-2017-8820 CVE-2017-8822 CVE-2017-8823 Package : tor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-539 Summary ======= The package tor before version 0.3.1.9-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 0.3.1.9-1. # pacman -Syu "tor>=0.3.1.9-1" The problems have been fixed upstream in version 0.3.1.9. Workaround ========== None. Description =========== - CVE-2017-8819 (information disclosure) An issue has been found in the way Tor before 0.3.1.9 checked for replays, leading to a possible traffic confirmation attack. - CVE-2017-8820 (denial of service) A denial of service issue where an attacker could crash a directory authority using a malformed router descriptor has been found in Tor before 0.3.1.9. - CVE-2017-8822 (information disclosure) In Tor before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012. - CVE-2017-8823 (arbitrary code execution) A use-after-free vulnerability has been found in Tor before 0.3.1.9, leading to a crash of v2 Tor onion services when they failed to open circuits while expiring introduction points. Impact ====== A remote attacker might be able to reduce the anonymity of Tor users, cause a denial of service or execute arbitrary code on the affected host. References ========== https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-030… https://trac.torproject.org/projects/tor/ticket/24244 https://trac.torproject.org/projects/tor/ticket/24245 https://bugs.torproject.org/21534 https://bugs.torproject.org/24333 https://trac.torproject.org/projects/tor/ticket/24313 https://security.archlinux.org/CVE-2017-8819 https://security.archlinux.org/CVE-2017-8820 https://security.archlinux.org/CVE-2017-8822 https://security.archlinux.org/CVE-2017-8823

1 0

[ASA-201712-9] openssl-1.0: multiple issues
by Remi Gacogne 16 Dec '17

16 Dec '17

Arch Linux Security Advisory ASA-201712-9 ========================================= Severity: Medium Date : 2017-12-16 CVE-ID : CVE-2017-3735 CVE-2017-3736 Package : openssl-1.0 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-479 Summary ======= The package openssl-1.0 before version 1.0.2.m-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 1.0.2.m-1. # pacman -Syu "openssl-1.0>=1.0.2.m-1" The problems have been fixed upstream in version 1.0.2.m. Workaround ========== None. Description =========== - CVE-2017-3735 (denial of service) A security issue has been found in OpenSSL < 1.1.0g. If an X.509 certificate has a malformed IPAddressFamily extension, OpenSSL could do a one-byte buffer overread. The most likely result would be an erroneous display of the certificate in text format. - CVE-2017-3736 (information disclosure) A carry propagation bug has been found in OpenSSL < 1.1.0g in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. Impact ====== A remote attacker can cause a denial of service via a crafted X.509 certificate. A remote attacker with online access to an unpatched system on a vulnerable architecture can access sensitive information like a private key. References ========== https://www.openssl.org/news/vulnerabilities.html#2017-3735 https://www.openssl.org/news/secadv/20170828.txt https://github.com/openssl/openssl/commit/b23171744b01e473ebbfd6edad70c1c38… https://www.openssl.org/news/vulnerabilities.html#2017-3736 https://www.openssl.org/news/secadv/20171102.txt https://github.com/openssl/openssl/commit/668a709a8d7ea374ee72ad2d43ac72ec6… https://security.archlinux.org/CVE-2017-3735 https://security.archlinux.org/CVE-2017-3736

1 0

[ASA-201712-8] chromium: cross-site scripting
by Remi Gacogne 16 Dec '17

16 Dec '17

Arch Linux Security Advisory ASA-201712-8 ========================================= Severity: High Date : 2017-12-16 CVE-ID : CVE-2017-15429 Package : chromium Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-546 Summary ======= The package chromium before version 63.0.3239.108-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 63.0.3239.108-1. # pacman -Syu "chromium>=63.0.3239.108-1" The problem has been fixed upstream in version 63.0.3239.108. Workaround ========== None. Description =========== A universal XSS has been found in the V8 component of the Chromium browser before 63.0.3239.108. Impact ====== A remote attacker can inject Javascript code via a universal cross-site scripting flaw. References ========== https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-des… https://crbug.com/788453 https://security.archlinux.org/CVE-2017-15429

1 0

[ASA-201712-7] quagga: denial of service
by Christian Rebischke 13 Dec '17

13 Dec '17

Arch Linux Security Advisory ASA-201712-7 ========================================= Severity: Medium Date : 2017-12-13 CVE-ID : CVE-2017-16227 Package : quagga Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-481 Summary ======= The package quagga before version 1.2.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.2.2-1. # pacman -Syu "quagga>=1.2.2-1" The problem has been fixed upstream in version 1.2.2. Workaround ========== None. Description =========== A denial of service flaw was found in the way the bgpd daemon in quagga before 1.2.2 handled the processing of large BGP update messages. A remote, previously trusted attacker could potentially use this flaw to cause bgpd to terminate existing BGP sessions, thereby leading to denial of service. Impact ====== A remote previously trusted attacker is able to crash quagga with a maliciously crafted message. References ========== https://bugs.archlinux.org/task/56250 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=879474 https://lists.quagga.net/pipermail/quagga-dev/2017-September/033284.html https://git.savannah.gnu.org/cgit/quagga.git/commit/?id=7a42b78be9a4108d988… https://security.archlinux.org/CVE-2017-16227

1 0

[ASA-201712-6] qt5-webengine: multiple issues
by Santiago Torres-Arias 13 Dec '17

13 Dec '17

Arch Linux Security Advisory ASA-201712-6 ========================================= Severity: Critical Date : 2017-12-13 CVE-ID : CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15390 CVE-2017-15392 CVE-2017-15394 CVE-2017-5124 CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129 CVE-2017-5132 CVE-2017-5133 Package : qt5-webengine Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-545 Summary ======= The package qt5-webengine before version 5.10.0-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, access restriction bypass, content spoofing and information disclosure. Resolution ========== Upgrade to 5.10.0-1. # pacman -Syu "qt5-webengine>=5.10.0-1" The problems have been fixed upstream in version 5.10.0. Workaround ========== None. Description =========== - CVE-2017-15386 (content spoofing) A UI spoofing issue has been found in the Blink component of the Chromium browser < 62.0.3202.62. - CVE-2017-15387 (access restriction bypass) A content security bypass has been found in the Chromium browser < 62.0.3202.62. - CVE-2017-15388 (information disclosure) An out-of-bounds read has been found in the Skia component of the Chromium browser < 62.0.3202.62. - CVE-2017-15390 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser < 62.0.3202.62. - CVE-2017-15392 (access restriction bypass) An incorrect registry key handling issue has been found in the PlatformIntegration component of the Chromium browser < 62.0.3202.62. - CVE-2017-15394 (content spoofing) A URL spoofing flaw has been found in the extensions UI of the Chromium browser < 62.0.3202.62. - CVE-2017-5124 (cross-site scripting) A universal XSS flaw has been found in the MHTML component of the Chromium browser < 62.0.3202.62. - CVE-2017-5126 (arbitrary code execution) A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62. - CVE-2017-5127 (arbitrary code execution) A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62. - CVE-2017-5128 (arbitrary code execution) A heap overflow security issue has been found in the WebGL component of the Chromium browser < 62.0.3202.62. - CVE-2017-5129 (arbitrary code execution) A use-after-free security issue has been found in the WebAudio component of the Chromium browser < 62.0.3202.62. - CVE-2017-5132 (arbitrary code execution) An incorrect stack manipulation security issue has been found in the WebAssembly component of the Chromium browser < 62.0.3202.62. - CVE-2017-5133 (arbitrary code execution) An out-of-bounds write has been found in the Skia component of the Chromium browser < 62.0.3202.62. Impact ====== A remote attacker can bypass security measures, trick the user by spoofing parts of the UI, cause a denial of service or execute arbitrary code on the affected host. References ========== https://github.com/qt/qtwebengine/blob/5.10/dist/changes-5.10.0#L37 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-des… https://crbug.com/752003 https://crbug.com/756040 https://crbug.com/756563 https://crbug.com/750239 https://crbug.com/714401 https://crbug.com/745580 https://crbug.com/762930 https://crbug.com/760455 https://crbug.com/765384 https://crbug.com/765469 https://crbug.com/765495 https://crbug.com/718858 https://crbug.com/762106 https://security.archlinux.org/CVE-2017-15386 https://security.archlinux.org/CVE-2017-15387 https://security.archlinux.org/CVE-2017-15388 https://security.archlinux.org/CVE-2017-15390 https://security.archlinux.org/CVE-2017-15392 https://security.archlinux.org/CVE-2017-15394 https://security.archlinux.org/CVE-2017-5124 https://security.archlinux.org/CVE-2017-5126 https://security.archlinux.org/CVE-2017-5127 https://security.archlinux.org/CVE-2017-5128 https://security.archlinux.org/CVE-2017-5129 https://security.archlinux.org/CVE-2017-5132 https://security.archlinux.org/CVE-2017-5133

1 0

[ASA-201712-5] chromium: multiple issues
by Remi Gacogne 07 Dec '17

07 Dec '17

Arch Linux Security Advisory ASA-201712-5 ========================================= Severity: Critical Date : 2017-12-07 CVE-ID : CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-544 Summary ======= The package chromium before version 63.0.3239.84-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure and access restriction bypass. Resolution ========== Upgrade to 63.0.3239.84-1. # pacman -Syu "chromium>=63.0.3239.84-1" The problems have been fixed upstream in version 63.0.3239.84. Workaround ========== None. Description =========== - CVE-2017-15407 (arbitrary code execution) An out of bounds write has been found in the QUIC component of the Chromium browser before 63.0.3239.84. - CVE-2017-15408 (arbitrary code execution) A heap-based buffer overflow has been found in the PDFium component of the Chromium browser before 63.0.3239.84. - CVE-2017-15409 (arbitrary code execution) An out of bounds write has been found in the Skia component of the Chromium browser before 63.0.3239.84. - CVE-2017-15410 (arbitrary code execution) A use after free has been found in the PDFium component of the Chromium browser before 63.0.3239.84. - CVE-2017-15411 (arbitrary code execution) A use after free has been found in the PDFium component of the Chromium browser before 63.0.3239.84. - CVE-2017-15412 (arbitrary code execution) A use after free has been found in the libxml component of the Chromium browser before 63.0.3239.84. - CVE-2017-15413 (arbitrary code execution) A type confusion has been found in the WebAssembly component of the Chromium browser before 63.0.3239.84. - CVE-2017-15415 (information disclosure) A pointer information disclosure has been found in the IPC call component of the Chromium browser before 63.0.3239.84. - CVE-2017-15416 (information disclosure) An out of bounds read has been found in the Blink component of the Chromium browser before 63.0.3239.84. - CVE-2017-15417 (information disclosure) A cross-origin information disclosure has been found in the Skia component of the Chromium browser before 63.0.3239.84. - CVE-2017-15418 (information disclosure) A use of uninitialized value has been found in the Skia component of the Chromium browser before 63.0.3239.84. - CVE-2017-15419 (information disclosure) A cross-origin leak of redirect URL has been found in the Blink component of the Chromium browser before 63.0.3239.84. - CVE-2017-15420 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser before 63.0.3239.84. - CVE-2017-15422 (arbitrary code execution) An integer overflow has been found in the ICU component of the Chromium browser before 63.0.3239.84. - CVE-2017-15423 (information disclosure) An information disclosure issue has been found in the SPAKE implementation of the BoringSSL component of the Chromium browser before 63.0.3239.84. - CVE-2017-15424 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser before 63.0.3239.84. - CVE-2017-15425 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser before 63.0.3239.84. - CVE-2017-15426 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser before 63.0.3239.84. - CVE-2017-15427 (access restriction bypass) An insufficient blocking of Javascript issue has been found in the Omnibox component of the Chromium browser before 63.0.3239.84. Impact ====== A remote attacker can execute arbitrary code on the affected host, spoof the URL, access sensitive information and bypass security measures. References ========== https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-des… https://crbug.com/778505 https://crbug.com/762374 https://crbug.com/763972 https://crbug.com/765921 https://crbug.com/770148 https://crbug.com/727039 https://crbug.com/766666 https://crbug.com/765512 https://crbug.com/779314 https://crbug.com/699028 https://crbug.com/765858 https://crbug.com/780312 https://crbug.com/777419 https://crbug.com/774382 https://github.com/google/boringssl/commit/696c13bd6ab78011adfe7b775519c8b7… https://crbug.com/778101 https://crbug.com/756226 https://crbug.com/756456 https://crbug.com/756735 https://crbug.com/768910 https://security.archlinux.org/CVE-2017-15407 https://security.archlinux.org/CVE-2017-15408 https://security.archlinux.org/CVE-2017-15409 https://security.archlinux.org/CVE-2017-15410 https://security.archlinux.org/CVE-2017-15411 https://security.archlinux.org/CVE-2017-15412 https://security.archlinux.org/CVE-2017-15413 https://security.archlinux.org/CVE-2017-15415 https://security.archlinux.org/CVE-2017-15416 https://security.archlinux.org/CVE-2017-15417 https://security.archlinux.org/CVE-2017-15418 https://security.archlinux.org/CVE-2017-15419 https://security.archlinux.org/CVE-2017-15420 https://security.archlinux.org/CVE-2017-15422 https://security.archlinux.org/CVE-2017-15423 https://security.archlinux.org/CVE-2017-15424 https://security.archlinux.org/CVE-2017-15425 https://security.archlinux.org/CVE-2017-15426 https://security.archlinux.org/CVE-2017-15427

1 0

[arch-security] [ASA-201712-4] vlc: arbitrary code execution
by Santiago Torres-Arias 07 Dec '17

07 Dec '17

Arch Linux Security Advisory ASA-201712-4 ========================================= Severity: Critical Date : 2017-12-07 CVE-ID : CVE-2017-10699 CVE-2017-9300 Package : vlc Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-533 Summary ======= The package vlc before version 2.2.7-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.2.7-1. # pacman -Syu "vlc>=2.2.7-1" The problems have been fixed upstream in version 2.2.7. Workaround ========== None. Description =========== - CVE-2017-10699 (arbitrary code execution) It was discovered that avcodec 2.2.x, as used in VideoLAN VLC media player before 2.2.7, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a denial of service (application crash) or possibly code execution. - CVE-2017-9300 (arbitrary code execution) It was discovered that plugins\codec\libflac_plugin.so in VideoLAN VLC media player before 2.2.7 allows remote attackers to cause a heap corruption and application crash leading to denial of service or possibly execution of arbitrary code via a crafted FLAC file. Impact ====== A remote attacker is able to execute arbitrary code on the host by providing a maliciously-crafted media file to VLC. References ========== https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=6cc73bcad19da2cd… https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=a38a85db58c569cc… https://trac.videolan.org/vlc/ticket/18467 https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=55a82442cfea9dab… https://security.archlinux.org/CVE-2017-10699 https://security.archlinux.org/CVE-2017-9300

1 0

[arch-security] [ASA-201712-3] libofx: arbitrary code execution
by Morten Linderud 03 Dec '17

03 Dec '17

Arch Linux Security Advisory ASA-201712-3 ========================================= Severity: Medium Date : 2017-12-02 CVE-ID : CVE-2017-2816 Package : libofx Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-534 Summary ======= The package libofx before version 0.9.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.9.12-1. # pacman -Syu "libofx>=0.9.12-1" The problem has been fixed upstream in version 0.9.12. Workaround ========== None. Description =========== An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability. Impact ====== A remote attacker is able to crash the application, or possibly execute arbitrary code by providing a crafted file. References ========== https://bugs.archlinux.org/task/56539 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317 https://github.com/libofx/libofx/commit/a70934eea95c76a7737b83773bffe873893… https://security.archlinux.org/CVE-2017-2816

1 0

[arch-security] [ASA-201712-2] cacti: multiple issues
by Morten Linderud 03 Dec '17

03 Dec '17

Arch Linux Security Advisory ASA-201712-2 ========================================= Severity: High Date : 2017-12-02 CVE-ID : CVE-2017-16641 CVE-2017-16660 CVE-2017-16661 CVE-2017-16785 Package : cacti Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-537 Summary ======= The package cacti before version 1.1.28-1 is vulnerable to multiple issues including arbitrary code execution, arbitrary command execution, cross-site scripting and arbitrary filesystem access. Resolution ========== Upgrade to 1.1.28-1. # pacman -Syu "cacti>=1.1.28-1" The problems have been fixed upstream in version 1.1.28. Workaround ========== None. Description =========== - CVE-2017-16641 (arbitrary command execution) lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php. - CVE-2017-16660 (arbitrary code execution) Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header. - CVE-2017-16661 (arbitrary filesystem access) Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd. - CVE-2017-16785 (cross-site scripting) Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php. Impact ====== A remote authenticated admin user is able to read arbitrary files, execute arbitrary code and commands on the affected host. An unauthenticated user is able to perform cross-site scripting attacks. References ========== https://github.com/Cacti/cacti/commit/e8088bb6593e6a49d000c342d17402f01db87… https://github.com/Cacti/cacti/issues/1066 https://github.com/Cacti/cacti/commit/4e74f46fe24bed533fcfc8c8a43121ed59ce2… https://github.com/Cacti/cacti/commit/a179e8092dbff7406e39ca16c2823f4fe530f… https://github.com/Cacti/cacti/commit/c0f0ce27f0c281d7e1e57f91891c5ca9a92df… https://github.com/Cacti/cacti/commit/96d793f33ebf16c0b12e1ec779d7debb87990… https://github.com/Cacti/cacti/issues/1071 https://security.archlinux.org/CVE-2017-16641 https://security.archlinux.org/CVE-2017-16660 https://security.archlinux.org/CVE-2017-16661 https://security.archlinux.org/CVE-2017-16785

1 0