May 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201705-25] sudo: access restriction bypass
by Levente Polyak 30 May '17

30 May '17

Arch Linux Security Advisory ASA-201705-25 ========================================== Severity: Medium Date : 2017-05-30 CVE-ID : CVE-2017-1000367 Package : sudo Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-282 Summary ======= The package sudo before version 1.8.20.p1-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.8.20.p1-1. # pacman -Syu "sudo>=1.8.20.p1-1" The problem has been fixed upstream in version 1.8.20.p1. Workaround ========== None. Description =========== On Linux systems, sudo parses the /proc/[pid]/stat file to determine the device number of the process's tty (field 7). The fields in the file are space-delimited, but it is possible for the command name (field 2) to include spaces, which sudo does not account for. A user with sudo privileges can cause sudo to use a device number of the user's choosing by creating a symbolic link from the sudo binary to a name that contains a space, followed by a number. This may allow a user to be able to bypass the "tty_ticket" constraints. In order for this to succeed there must exist on the machine a terminal device that the user has previously authenticated themselves on via sudo within the last time stamp timeout (5 minutes by default). Impact ====== A local attacker is able to extend the lifetime of a previously authenticated ticket beyond the "tty_ticket" timeout constraints. References ========== https://www.sudo.ws/alerts/linux_tty.html http://www.openwall.com/lists/oss-security/2017/05/30/16 https://www.sudo.ws/repos/sudo/raw-rev/b5460cbbb11b https://security.archlinux.org/CVE-2017-1000367

1 0

[arch-security] [ASA-201705-24] postgresql-libs: man-in-the-middle
by Remi Gacogne 30 May '17

30 May '17

Arch Linux Security Advisory ASA-201705-24 ========================================== Severity: High Date : 2017-05-30 CVE-ID : CVE-2017-7485 Package : postgresql-libs Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-280 Summary ======= The package postgresql-libs before version 9.6.3-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 9.6.3-1. # pacman -Syu "postgresql-libs>=9.6.3-1" The problem has been fixed upstream in version 9.6.3. Workaround ========== None. Description =========== A security issue has been found in the libpq component of PostgreSQL < 9.6.3, where the PGREQUIRESSL was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. Impact ====== A remote attacker in position of man-in-the-middle can intercept and alter every communication between a vulnerable client and a server. References ========== https://www.postgresql.org/about/news/1746/ https://security.archlinux.org/CVE-2017-7485

1 0

[arch-security] [ASA-201705-23] postgresql: information disclosure
by Remi Gacogne 30 May '17

30 May '17

Arch Linux Security Advisory ASA-201705-23 ========================================== Severity: Medium Date : 2017-05-30 CVE-ID : CVE-2017-7484 CVE-2017-7486 Package : postgresql Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-272 Summary ======= The package postgresql before version 9.6.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 9.6.3-1. # pacman -Syu "postgresql>=9.6.3-1" The problems have been fixed upstream in version 9.6.3. Workaround ========== None. Description =========== - CVE-2017-7484 (information disclosure) A security issue has been found in PostgreSQL < 9.6.3, where some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. - CVE-2017-7486 (information disclosure) A security issue has been found in PostgreSQL < 9.6.3, where the pg_user_mappings view disclosed user mapping options to any user having USAGE privilege on the associated foreign server, including the password. An attacker could then use the password to run arbitrary queries against the server or others accepting the same credentials, not just the limited queries one can issue via foreign tables. Impact ====== An unprivileged, authenticated attacker can access sensitive information on the vulnerable server. References ========== https://www.postgresql.org/about/news/1746/ https://security.archlinux.org/CVE-2017-7484 https://security.archlinux.org/CVE-2017-7486

1 0

[arch-security] [ASA-201705-22] samba: arbitrary code execution
by Remi Gacogne 30 May '17

30 May '17

Arch Linux Security Advisory ASA-201705-22 ========================================== Severity: High Date : 2017-05-30 CVE-ID : CVE-2017-7494 Package : samba Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-279 Summary ======= The package samba before version 4.5.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.5.10-1. # pacman -Syu "samba>=4.5.10-1" The problem has been fixed upstream in version 4.5.10. Workaround ========== Add the parameter: nt pipe support = no to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note that this can disable some expected functionality for Windows clients. Description =========== All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. Impact ====== A malicious authenticated client can execute arbitrary code on the affected host by uploading a shared library to a writable share. References ========== https://www.samba.org/samba/security/CVE-2017-7494.html https://security.archlinux.org/CVE-2017-7494

1 0

[arch-security] [ASA-201705-21] lib32-nss: arbitrary code execution
by Remi Gacogne 30 May '17

30 May '17

Arch Linux Security Advisory ASA-201705-21 ========================================== Severity: Critical Date : 2017-05-29 CVE-ID : CVE-2017-5461 Package : lib32-nss Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-248 Summary ======= The package lib32-nss before version 3.30.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.30.2-1. # pacman -Syu "lib32-nss>=3.30.2-1" The problem has been fixed upstream in version 3.30.2. Workaround ========== None. Description =========== An out-of-bounds write during Base64 decoding operation has been found in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library. The issue has been fixed in releases 3.29.5 and 3.30.1. Impact ====== A remote attacker can execute arbitrary code on the affected host, using a specially crafted certificate. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461 https://bugzilla.mozilla.org/show_bug.cgi?id=1344380 https://hg.mozilla.org/projects/nss/rev/ac34db053672 https://security.archlinux.org/CVE-2017-5461

1 0

[arch-security] [ASA-201705-20] lynis: arbitrary file overwrite
by Levente Polyak 22 May '17

22 May '17

Arch Linux Security Advisory ASA-201705-20 ========================================== Severity: High Date : 2017-05-22 CVE-ID : CVE-2017-8108 Package : lynis Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-278 Summary ======= The package lynis before version 2.5.0-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 2.5.0-1. # pacman -Syu "lynis>=2.5.0-1" The problem has been fixed upstream in version 2.5.0. Workaround ========== None. Description =========== Michael Scherer discovered that some Lynis tests reuse the same temporary file. As some tests remove the temporary file, this might give an attacker the possibility to perform a link following attack. While timing must be perfect, there is a very small time window in which the attack can recreate the temporary file and symlink it to another resource, like a file. In this case data may be overwritten, or possibly executed. Impact ====== A local unprivileged attacker is able to overwrite arbitrary files on the filesystem possibly leading to privilege escalation. References ========== https://bugs.archlinux.org/task/54067 https://cisofy.com/security/cve/cve-2017-8108/ https://security.archlinux.org/CVE-2017-8108

1 0

[arch-security] [ASA-201705-19] fop: xml external entity injection
by Christian Rebischke 21 May '17

21 May '17

Arch Linux Security Advisory ASA-201705-19 ========================================== Severity: Medium Date : 2017-05-21 CVE-ID : CVE-2017-5661 Package : fop Type : xml external entity injection Remote : Yes Link : https://security.archlinux.org/AVG-254 Summary ======= The package fop before version 2.2-1 is vulnerable to xml external entity injection. Resolution ========== Upgrade to 2.2-1. # pacman -Syu "fop>=2.2-1" The problem has been fixed upstream in version 2.2. Workaround ========== None. Description =========== Files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server (including confidential or sensitive files) would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack. Impact ====== A remote attacker is able to access files lying on the filesystem or crash the server via sending maliciously crafted SVG files. References ========== https://xmlgraphics.apache.org/security.html https://security.archlinux.org/CVE-2017-5661

1 0

[arch-security] [ASA-201705-18] libplist: multiple issues
by Santiago Torres-Arias 17 May '17

17 May '17

Arch Linux Security Advisory ASA-201705-18 ========================================== Severity: High Date : 2017-05-16 CVE-ID : CVE-2017-5209 CVE-2017-5545 CVE-2017-5834 CVE-2017-5835 CVE-2017-5836 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437 CVE-2017-6438 CVE-2017-6439 CVE-2017-6440 Package : libplist Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-215 Summary ======= The package libplist before version 2.0.0-1 is vulnerable to multiple issues including arbitrary command execution, denial of service and information disclosure. Resolution ========== Upgrade to 2.0.0-1. # pacman -Syu "libplist>=2.0.0-1" The problems have been fixed upstream in version 2.0.0. Workaround ========== None. Description =========== - CVE-2017-5209 (information disclosure) The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. - CVE-2017-5545 (denial of service) The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. - CVE-2017-5834 (denial of service) The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file. - CVE-2017-5835 (denial of service) libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. - CVE-2017-5836 (denial of service) The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free. - CVE-2017-6435 (denial of service) The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file. - CVE-2017-6436 (denial of service) The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file. - CVE-2017-6437 (denial of service) The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file. - CVE-2017-6438 (arbitrary command execution) Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file. - CVE-2017-6439 (denial of service) Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file. - CVE-2017-6440 (denial of service) The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file. Impact ====== An attacker is able to crash the process, read sensitive information or execute arbitrary code on the host by providing a crafted plist file or string. References ========== https://github.com/libimobiledevice/libplist/issues/93 https://github.com/libimobiledevice/libplist/issues/94 https://github.com/libimobiledevice/libplist/issues/95 https://github.com/libimobiledevice/libplist/issues/99 https://github.com/libimobiledevice/libplist/issues/98 https://github.com/libimobiledevice/libplist/issues/100 https://github.com/libimobiledevice/libplist/blob/master/NEWS https://bugzilla.redhat.com/show_bug.cgi?id=1412613 https://bugzilla.redhat.com/show_bug.cgi?id=1416002 https://bugzilla.redhat.com/show_bug.cgi?id=1418591 https://bugzilla.redhat.com/show_bug.cgi?id=1418592 https://bugzilla.redhat.com/show_bug.cgi?id=1418593 https://security.archlinux.org/CVE-2017-5209 https://security.archlinux.org/CVE-2017-5545 https://security.archlinux.org/CVE-2017-5834 https://security.archlinux.org/CVE-2017-5835 https://security.archlinux.org/CVE-2017-5836 https://security.archlinux.org/CVE-2017-6435 https://security.archlinux.org/CVE-2017-6436 https://security.archlinux.org/CVE-2017-6437 https://security.archlinux.org/CVE-2017-6438 https://security.archlinux.org/CVE-2017-6439 https://security.archlinux.org/CVE-2017-6440

1 0

[arch-security] [ASA-201705-17] lxc: insufficient validation
by Christian Rebischke 13 May '17

13 May '17

Arch Linux Security Advisory ASA-201705-17 ========================================== Severity: Low Date : 2017-05-13 CVE-ID : CVE-2017-5985 Package : lxc Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-204 Summary ======= The package lxc before version 1:2.0.8-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1:2.0.8-1. # pacman -Syu "lxc>=1:2.0.8-1" The problem has been fixed upstream in version 2.0.8. Workaround ========== None. Description =========== This security issue was reported by Jann Horn and has to do with a lack of netns ownership check in lxc-user-nic, which would allow any user with a lxc-usernet allocation to create network interfaces on the host including choosing the name of that network interface. The created interface wouldn't be UP so is unlikely to be automatically brought up or get an address, but this issue could be used to squat the name of a real system network interface before it appears. Impact ====== A local attacker is able to spoof a new network interface. References ========== https://lists.linuxcontainers.org/pipermail/lxc-users/2017-March/012925.html https://security.archlinux.org/CVE-2017-5985

1 0

[arch-security] [ASA-201705-16] openvpn: denial of service
by Remi Gacogne 13 May '17

13 May '17

Arch Linux Security Advisory ASA-201705-16 ========================================== Severity: High Date : 2017-05-13 CVE-ID : CVE-2017-7478 CVE-2017-7479 Package : openvpn Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-271 Summary ======= The package openvpn before version 2.4.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "openvpn>=2.4.2-1" The problems have been fixed upstream in version 2.4.2. Workaround ========== The most severe vulnerability, CVE-2017-7478, which allows a remote unauthenticated attacker to cause a denial of service, can be mitigated by setting up tls-auth or tls-crypt. Note that this requires changing both server and clients configurations. Description =========== - CVE-2017-7478 (denial of service) A security issue has been found in OpenVPN <= 2.4.1 where an unauthenticated attacker can send a packet with an unexpected payload size during SSL handshake, causing a server shutdown. Servers using tls-auth are protected against this attack as packets with an invalid HMAC are discarded before being processed by the vulnerable code. - CVE-2017-7479 (denial of service) A security issue has been found in OpenVPN <= 2.4.1 where an authenticated attacker can crash a server using an AEAD mode cipher by sending crafted data to exhaust the packet counter. Impact ====== A remote, unauthenticated attacker can crash a server not using tls- auth or tls-crypt by sending a packet with an unexpected payload size. A remote, authenticated attacker can crash a server using an AEAD mode cipher by sending crafted data to exhaust the packet counter. References ========== https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineer… https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quarkslab-results/ http://blog.quarkslab.com/security-assessment-of-openvpn.html https://security.archlinux.org/CVE-2017-7478 https://security.archlinux.org/CVE-2017-7479

1 0