June 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201706-5] libusbmuxd: access restriction bypass
by Santiago Torres-Arias 05 Jun '17

05 Jun '17

Arch Linux Security Advisory ASA-201706-5 ========================================= Severity: Medium Date : 2017-06-05 CVE-ID : CVE-2016-5104 Package : libusbmuxd Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-7 Summary ======= The package libusbmuxd before version 1.0.10-2 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.0.10-2. # pacman -Syu "libusbmuxd>=1.0.10-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers on the local network to bypass intended access restrictions and communicate with services on affected devices by connecting to an IPv4 TCP socket. Impact ====== A remote attacker is able to interact with a USB-connected device by connecting to a IPv4 TCP socket. References ========== https://git.archlinux.org/svntogit/packages.git/tree/trunk/CVE-2016-5104.pa… https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991… http://www.openwall.com/lists/oss-security/2016/05/26/6 https://security.archlinux.org/CVE-2016-5104

1 0

[arch-security] [ASA-201706-4] gajim: information disclosure
by Santiago Torres-Arias 05 Jun '17

05 Jun '17

Arch Linux Security Advisory ASA-201706-4 ========================================= Severity: High Date : 2017-06-05 CVE-ID : CVE-2016-1037 Package : gajim Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-284 Summary ======= The package gajim before version 0.16.8-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 0.16.8-1. # pacman -Syu "gajim>=0.16.8-1" The problem has been fixed upstream in version 0.16.8. Workaround ========== None. Description =========== Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions. Impact ====== A malicious attacker can extract user session data by leveraging the XEP-0146 (remote controlling clients) feature of the XMPP protocol, which is enabled by default. References ========== https://dev.gajim.org/gajim/gajim/issues/8378 https://dev.gajim.org/gajim/gajim/commit/cb65cfc5aed9efe05208ebbb7fb2d41fcf… https://security.archlinux.org/CVE-2016-1037

1 0

[arch-security] [ASA-201706-3] libtasn1: arbitrary code execution
by Remi Gacogne 02 Jun '17

02 Jun '17

Arch Linux Security Advisory ASA-201706-3 ========================================= Severity: High Date : 2017-06-02 CVE-ID : CVE-2017-6891 Package : libtasn1 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-285 Summary ======= The package libtasn1 before version 4.11-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.11-1. # pacman -Syu "libtasn1>=4.11-1" The problem has been fixed upstream in version 4.11. Workaround ========== None. Description =========== Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility. Impact ====== A remote attacker can execute arbitrary code on the affected host by tricking a local user into processing a specially crafted assignments file. References ========== https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=5520704d… https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/ https://security.archlinux.org/CVE-2017-6891

1 0

[arch-security] [ASA-201706-2] freeradius: authentication bypass
by Remi Gacogne 02 Jun '17

02 Jun '17

Arch Linux Security Advisory ASA-201706-2 ========================================= Severity: High Date : 2017-06-02 CVE-ID : CVE-2017-9148 Package : freeradius Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-281 Summary ======= The package freeradius before version 3.0.14-3 is vulnerable to authentication bypass. Resolution ========== Upgrade to 3.0.14-3. # pacman -Syu "freeradius>=3.0.14-3" The problem has been fixed upstream in version 3.0.14. Workaround ========== None. Description =========== A security issue has been found in FreeRADIUS < 3.0.14. The implementation of TTLS and PEAP in FreeRADIUS skips inner authentication when it handles a resumed TLS connection. This is a feature but there is a critical catch: the server must never allow resumption of a TLS session until its initial connection gets to the point where inner authentication has been finished successfully. Unfortunately, affected versions of FreeRADIUS fail to reliably prevent resumption of unauthenticated sessions unless the TLS session cache is disabled completely and allow an attacker (e.g. a malicious supplicant) to elicit EAP Success without sending any valid credentials. Impact ====== A remote user can bypass authentication by starting then resuming an unauthenticated TLS session. References ========== http://freeradius.org/press/index.html#3.0.14 http://seclists.org/oss-sec/2017/q2/342 https://security.archlinux.org/CVE-2017-9148

1 0

[arch-security] [ASA-201706-1] vlc: multiple issues
by Levente Polyak 01 Jun '17

01 Jun '17

Arch Linux Security Advisory ASA-201706-1 ========================================= Severity: High Date : 2017-06-01 CVE-ID : CVE-2017-8310 CVE-2017-8311 CVE-2017-8312 Package : vlc Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-283 Summary ======= The package vlc before version 2.2.6-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.2.6-1. # pacman -Syu "vlc>=2.2.6-1" The problems have been fixed upstream in version 2.2.6. Workaround ========== None. Description =========== - CVE-2017-8310 (denial of service) Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file. - CVE-2017-8311 (arbitrary code execution) Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file. - CVE-2017-8312 (denial of service) Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file. Impact ====== A local attacker is able to use a specially crafted subtitles file to crash the application or execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/54194 http://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=7cac839692ab79dbf… http://git.videolan.org/?p=vlc.git;a=commitdiff;h=775de716add17322f24b47643… http://git.videolan.org/?p=vlc.git;a=commitdiff;h=611398fc8d32f3fe4331f60b2… https://security.archlinux.org/CVE-2017-8310 https://security.archlinux.org/CVE-2017-8311 https://security.archlinux.org/CVE-2017-8312

1 0