June 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201706-15] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 14 Jun '17

14 Jun '17

Arch Linux Security Advisory ASA-201706-15 ========================================== Severity: Critical Date : 2017-06-14 CVE-ID : CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-298 Summary ======= The package lib32-flashplugin before version 26.0.0.126-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 26.0.0.126-1. # pacman -Syu "lib32-flashplugin>=26.0.0.126-1" The problems have been fixed upstream in version 26.0.0.126. Workaround ========== None. Description =========== - CVE-2017-3075 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3076 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3077 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3078 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3079 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3081 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3082 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3083 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3084 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-17.html https://security.archlinux.org/CVE-2017-3075 https://security.archlinux.org/CVE-2017-3076 https://security.archlinux.org/CVE-2017-3077 https://security.archlinux.org/CVE-2017-3078 https://security.archlinux.org/CVE-2017-3079 https://security.archlinux.org/CVE-2017-3081 https://security.archlinux.org/CVE-2017-3082 https://security.archlinux.org/CVE-2017-3083 https://security.archlinux.org/CVE-2017-3084

1 0

[arch-security] [ASA-201706-14] flashplugin: arbitrary code execution
by Remi Gacogne 14 Jun '17

14 Jun '17

Arch Linux Security Advisory ASA-201706-14 ========================================== Severity: Critical Date : 2017-06-14 CVE-ID : CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-297 Summary ======= The package flashplugin before version 26.0.0.126-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 26.0.0.126-1. # pacman -Syu "flashplugin>=26.0.0.126-1" The problems have been fixed upstream in version 26.0.0.126. Workaround ========== None. Description =========== - CVE-2017-3075 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3076 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3077 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3078 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3079 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3081 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3082 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3083 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3084 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-17.html https://security.archlinux.org/CVE-2017-3075 https://security.archlinux.org/CVE-2017-3076 https://security.archlinux.org/CVE-2017-3077 https://security.archlinux.org/CVE-2017-3078 https://security.archlinux.org/CVE-2017-3079 https://security.archlinux.org/CVE-2017-3081 https://security.archlinux.org/CVE-2017-3082 https://security.archlinux.org/CVE-2017-3083 https://security.archlinux.org/CVE-2017-3084

1 0

[arch-security] [ASA-201706-13] tor: denial of service
by Levente Polyak 13 Jun '17

13 Jun '17

Arch Linux Security Advisory ASA-201706-13 ========================================== Severity: Medium Date : 2017-06-13 CVE-ID : CVE-2017-0375 CVE-2017-0376 Package : tor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-296 Summary ======= The package tor before version 0.3.0.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.3.0.8-1. # pacman -Syu "tor>=0.3.0.8-1" The problems have been fixed upstream in version 0.3.0.8. Workaround ========== None. Description =========== - CVE-2017-0375 (denial of service) The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell. - CVE-2017-0376 (denial of service) The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit. Impact ====== A remote attacker is able to send specially crafted input to the hidden-service feature of tor to crash the application. References ========== https://bugs.archlinux.org/task/54439 https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html https://trac.torproject.org/projects/tor/ticket/22493 https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f0… https://trac.torproject.org/projects/tor/ticket/22494 https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939… https://security.archlinux.org/CVE-2017-0375 https://security.archlinux.org/CVE-2017-0376

1 0

[arch-security] [ASA-201706-12] gnutls: denial of service
by Remi Gacogne 13 Jun '17

13 Jun '17

Arch Linux Security Advisory ASA-201706-12 ========================================== Severity: Medium Date : 2017-06-13 CVE-ID : CVE-2017-7507 Package : gnutls Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-294 Summary ======= The package gnutls before version 3.5.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.13-1. # pacman -Syu "gnutls>=3.5.13-1" The problem has been fixed upstream in version 3.5.13. Workaround ========== None. Description =========== A security issue has been found in GnuTLS < 3.5.13, where decoding a status request TLS extension that has a non-empty responder IDs list could lead to a crash due to a null pointer dereference. Impact ====== A remote attacker can crash a vulnerable TLS server by sending a crafted status_request extension in a ClientHello message. References ========== https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 https://bugzilla.redhat.com/show_bug.cgi?id=1454621 https://security.archlinux.org/CVE-2017-7507

1 0

[arch-security] [ASA-201706-11] irssi: denial of service
by Remi Gacogne 12 Jun '17

12 Jun '17

Arch Linux Security Advisory ASA-201706-11 ========================================== Severity: Medium Date : 2017-06-12 CVE-ID : CVE-2017-9468 CVE-2017-9469 Package : irssi Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-293 Summary ======= The package irssi before version 1.0.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.3-1. # pacman -Syu "irssi>=1.0.3-1" The problems have been fixed upstream in version 1.0.3. Workaround ========== None. Description =========== - CVE-2017-9468 (denial of service) In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash. - CVE-2017-9469 (denial of service) In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash. Impact ====== A remote attacker can cause a denial of service by sending a crafted DCC message. References ========== https://github.com/irssi/irssi/commit/fb08fc7f1aa6b2e616413d003bf021612301a… http://openwall.com/lists/oss-security/2017/06/06/4 https://irssi.org/security/irssi_sa_2017_06.txt https://security.archlinux.org/CVE-2017-9468 https://security.archlinux.org/CVE-2017-9469

1 0

[arch-security] [ASA-201706-10] lib32-libtasn1: arbitrary code execution
by Remi Gacogne 12 Jun '17

12 Jun '17

Arch Linux Security Advisory ASA-201706-10 ========================================== Severity: High Date : 2017-06-12 CVE-ID : CVE-2017-6891 Package : lib32-libtasn1 Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-286 Summary ======= The package lib32-libtasn1 before version 4.11-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.11-1. # pacman -Syu "lib32-libtasn1>=4.11-1" The problem has been fixed upstream in version 4.11. Workaround ========== None. Description =========== Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility. Impact ====== An attacker can execute arbitrary code on the affected host by tricking a local user into processing a specially crafted assignments file. References ========== https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=5520704d… https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/ https://security.archlinux.org/CVE-2017-6891

1 0

[arch-security] [ASA-201706-9] wireshark-cli: denial of service
by Remi Gacogne 12 Jun '17

12 Jun '17

Arch Linux Security Advisory ASA-201706-9 ========================================= Severity: Low Date : 2017-06-12 CVE-ID : CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346 CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350 CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-287 Summary ======= The package wireshark-cli before version 2.2.7-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.2.7-1. # pacman -Syu "wireshark-cli>=2.2.7-1" The problems have been fixed upstream in version 2.2.7. Workaround ========== None. Description =========== - CVE-2017-9343 (denial of service) An issue has been found in the MSNIP dissector of Wireshark < 2.2.7, where NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9344 (denial of service) An issue has been found in the BT L2CAP dissector of Wireshark < 2.2.7, where a division by zero can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9345 (denial of service) An issue has been found in the DNS dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9346 (denial of service) An issue has been found in the SoulSeek dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9347 (denial of service) An issue has been found in the ROS dissector of Wireshark < 2.2.7, where an NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9348 (denial of service) An issue has been found in the DOF dissector of Wireshark < 2.2.7, where a heap-based out-of-bounds read can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9349 (denial of service) An issue has been found in the DICOM dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9350 (denial of service) An issue has been found in the openSAFETY dissector of Wireshark < 2.2.7, where an over-sized memory allocation can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9351 (denial of service) An issue has been found in the DHCP dissector of Wireshark < 2.2.7, where a heap-based out-of-bounds read can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9352 (denial of service) An issue has been found in the bazaar dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9353 (denial of service) An issue has been found in the IPv6 dissector of Wireshark < 2.2.7, where a NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9354 (denial of service) An issue has been found in the RGMP dissector of Wireshark < 2.2.7, where a NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker can cause a denial of service by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. References ========== https://www.wireshark.org/docs/relnotes/wireshark-2.2.7.html https://www.wireshark.org/security/wnpa-sec-2017-30.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13725 https://www.wireshark.org/security/wnpa-sec-2017-29.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13701 https://www.wireshark.org/security/wnpa-sec-2017-26.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13633 https://www.wireshark.org/security/wnpa-sec-2017-25.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13631 https://www.wireshark.org/security/wnpa-sec-2017-31.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13637 https://www.wireshark.org/security/wnpa-sec-2017-23.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13608 https://www.wireshark.org/security/wnpa-sec-2017-27.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13685 https://www.wireshark.org/security/wnpa-sec-2017-28.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13649 https://www.wireshark.org/security/wnpa-sec-2017-24.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13609 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13628 https://www.wireshark.org/security/wnpa-sec-2017-22.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13599 https://www.wireshark.org/security/wnpa-sec-2017-33.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13675 https://www.wireshark.org/security/wnpa-sec-2017-32.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13646 https://security.archlinux.org/CVE-2017-9343 https://security.archlinux.org/CVE-2017-9344 https://security.archlinux.org/CVE-2017-9345 https://security.archlinux.org/CVE-2017-9346 https://security.archlinux.org/CVE-2017-9347 https://security.archlinux.org/CVE-2017-9348 https://security.archlinux.org/CVE-2017-9349 https://security.archlinux.org/CVE-2017-9350 https://security.archlinux.org/CVE-2017-9351 https://security.archlinux.org/CVE-2017-9352 https://security.archlinux.org/CVE-2017-9353 https://security.archlinux.org/CVE-2017-9354

1 0

[arch-security] [ASA-201706-8] chromium: multiple issues
by Remi Gacogne 07 Jun '17

07 Jun '17

Arch Linux Security Advisory ASA-201706-8 ========================================= Severity: Critical Date : 2017-06-07 CVE-ID : CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081 CVE-2017-5082 CVE-2017-5083 CVE-2017-5085 CVE-2017-5086 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-289 Summary ======= The package chromium before version 59.0.3071.86-1 is vulnerable to multiple issues including arbitrary code execution, arbitrary command execution, authentication bypass, content spoofing, information disclosure, cross-site scripting and insufficient validation. Resolution ========== Upgrade to 59.0.3071.86-1. # pacman -Syu "chromium>=59.0.3071.86-1" The problems have been fixed upstream in version 59.0.3071.86. Workaround ========== None. Description =========== - CVE-2017-5070 (arbitrary code execution) A type confusion flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5071 (information disclosure) An out of bounds read flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5072 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. - CVE-2017-5073 (arbitrary code execution) A use-after-free flaw has been found in the print preview component of the Chromium browser. - CVE-2017-5074 (arbitrary code execution) A use-after-free flaw has been found in the Apps Bluetooth component of the Chromium browser. - CVE-2017-5075 (information disclosure) An information leak flaw has been found in the CSP reporting component of the Chromium browser. - CVE-2017-5076 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. - CVE-2017-5077 (arbitrary code execution) A heap buffer overflow flaw was found in the Skia component of the Chromium browser. - CVE-2017-5078 (arbitrary command execution) A possible command injection flaw has been found in the mailto handling component of the Chromium browser. - CVE-2017-5079 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5080 (arbitrary code execution) A use-after-free flaw has been found in the credit card autofill component of the Chromium browser. - CVE-2017-5081 (authentication bypass) A extension verification bypass has been found in the Chromium browser. - CVE-2017-5082 (insufficient validation) An insufficient hardening flaw has been found in the credit card editor component of the Chromium browser. - CVE-2017-5083 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5085 (cross-site scripting) A security issue has been found in the Chromium browser, where javascript is inappropriately executed on WebUI pages - CVE-2017-5086 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. Impact ====== A remote attacker can access sensitive information, spoof content, bypass security measures and execute arbitrary code and commands on the affected host. References ========== https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=722756 https://bugs.chromium.org/p/chromium/issues/detail?id=715582 https://bugs.chromium.org/p/chromium/issues/detail?id=709417 https://bugs.chromium.org/p/chromium/issues/detail?id=716474 https://bugs.chromium.org/p/chromium/issues/detail?id=700040 https://bugs.chromium.org/p/chromium/issues/detail?id=678776 https://bugs.chromium.org/p/chromium/issues/detail?id=719199 https://bugs.chromium.org/p/chromium/issues/detail?id=716311 https://bugs.chromium.org/p/chromium/issues/detail?id=711020 https://bugs.chromium.org/p/chromium/issues/detail?id=713686 https://bugs.chromium.org/p/chromium/issues/detail?id=708819 https://bugs.chromium.org/p/chromium/issues/detail?id=672008 https://bugs.chromium.org/p/chromium/issues/detail?id=721579 https://bugs.chromium.org/p/chromium/issues/detail?id=714849 https://bugs.chromium.org/p/chromium/issues/detail?id=692378 https://bugs.chromium.org/p/chromium/issues/detail?id=722639 https://security.archlinux.org/CVE-2017-5070 https://security.archlinux.org/CVE-2017-5071 https://security.archlinux.org/CVE-2017-5072 https://security.archlinux.org/CVE-2017-5073 https://security.archlinux.org/CVE-2017-5074 https://security.archlinux.org/CVE-2017-5075 https://security.archlinux.org/CVE-2017-5076 https://security.archlinux.org/CVE-2017-5077 https://security.archlinux.org/CVE-2017-5078 https://security.archlinux.org/CVE-2017-5079 https://security.archlinux.org/CVE-2017-5080 https://security.archlinux.org/CVE-2017-5081 https://security.archlinux.org/CVE-2017-5082 https://security.archlinux.org/CVE-2017-5083 https://security.archlinux.org/CVE-2017-5085 https://security.archlinux.org/CVE-2017-5086

1 0

[arch-security] [ASA-201706-7] tomcat8: access restriction bypass
by Remi Gacogne 06 Jun '17

06 Jun '17

Arch Linux Security Advisory ASA-201706-7 ========================================= Severity: High Date : 2017-06-06 CVE-ID : CVE-2017-5664 Package : tomcat8 Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-291 Summary ======= The package tomcat8 before version 8.0.44-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 8.0.44-1. # pacman -Syu "tomcat8>=8.0.44-1" The problem has been fixed upstream in version 8.0.44. Workaround ========== None. Description =========== A security issue has been found in Apache Tomcat < 7.0.18 and < 8.0.44. The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve the content of the file as if processing a GET request, regardless of the actual HTTP method. Tomcat's Default Servlet did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Impact ====== A remote attacker can alter, replace or remove the custom error page of an affected server by sending an HTTP request with a specific method. References ========== https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78 https://svn.apache.org/viewvc?view=revision&revision=1793471 https://svn.apache.org/viewvc?view=revision&revision=1793491 https://security.archlinux.org/CVE-2017-5664

1 0

[arch-security] [ASA-201706-6] tomcat7: access restriction bypass
by Remi Gacogne 06 Jun '17

06 Jun '17

Arch Linux Security Advisory ASA-201706-6 ========================================= Severity: High Date : 2017-06-06 CVE-ID : CVE-2017-5664 Package : tomcat7 Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-290 Summary ======= The package tomcat7 before version 7.0.78-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 7.0.78-1. # pacman -Syu "tomcat7>=7.0.78-1" The problem has been fixed upstream in version 7.0.78. Workaround ========== None. Description =========== A security issue has been found in Apache Tomcat < 7.0.18 and < 8.0.44. The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve the content of the file as if processing a GET request, regardless of the actual HTTP method. Tomcat's Default Servlet did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Impact ====== A remote attacker can alter, replace or remove the custom error page of an affected server by sending an HTTP request with a specific method. References ========== https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44 https://svn.apache.org/viewvc?view=revision&revision=1793471 https://svn.apache.org/viewvc?view=revision&revision=1793491 https://security.archlinux.org/CVE-2017-5664

1 0