September 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201709-4] linux-hardened: arbitrary code execution
by Levente Polyak 13 Sep '17

13 Sep '17

Arch Linux Security Advisory ASA-201709-4 ========================================= Severity: High Date : 2017-09-13 CVE-ID : CVE-2017-1000251 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-395 Summary ======= The package linux-hardened before version 4.13.1.b-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.13.1.b-1. # pacman -Syu "linux-hardened>=4.13.1.b-1" The problem has been fixed upstream in version 4.13.1.b. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55602 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0

[arch-security] [ASA-201709-3] bluez: information disclosure
by Levente Polyak 12 Sep '17

12 Sep '17

Arch Linux Security Advisory ASA-201709-3 ========================================= Severity: High Date : 2017-09-12 CVE-ID : CVE-2017-1000250 Package : bluez Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-396 Summary ======= The package bluez before version 5.46-2 is vulnerable to information disclosure. Resolution ========== Upgrade to 5.46-2. # pacman -Syu "bluez>=5.46-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery Protocol (SDP). A specially crafted Bluetooth device could, without prior pairing or user interaction, retrieve portions of the bluetoothd process memory, including potentially sensitive information such as Bluetooth encryption keys. Impact ====== A remote attacker is able to use a specially crafted Bluetooth device to obtain sensitive information such as Bluetooth encryption keys. References ========== https://bugs.archlinux.org/task/55603 https://www.armis.com/blueborne/ http://pkgs.fedoraproject.org/cgit/rpms/bluez.git/plain/0010-Out-of-bounds-… https://security.archlinux.org/CVE-2017-1000250

1 0

[arch-security] [ASA-201709-2] postgresql: multiple issues
by Levente Polyak 06 Sep '17

06 Sep '17

Arch Linux Security Advisory ASA-201709-2 ========================================= Severity: High Date : 2017-09-06 CVE-ID : CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 Package : postgresql Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-381 Summary ======= The package postgresql before version 9.6.4-1 is vulnerable to multiple issues including information disclosure, access restriction bypass and authentication bypass. Resolution ========== Upgrade to 9.6.4-1. # pacman -Syu "postgresql>=9.6.4-1" The problems have been fixed upstream in version 9.6.4. Workaround ========== None. Description =========== - CVE-2017-7546 (authentication bypass) It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. - CVE-2017-7547 (information disclosure) An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. - CVE-2017-7548 (access restriction bypass) An authorization flaw was found in the way PostgreSQL handled large objects. A remote authenticated attacker with no privileges on a large object could potentially use this flaw to overwrite the entire content of the object, thus resulting in denial of service. Impact ====== A remote unauthenticated attacker is be able to gain access to database accounts with empty passwords. Additionally a remote authenticated user may be able to perform a denial of service attack or retrieve passwords from the user mappings. References ========== https://www.postgresql.org/about/news/1772/ https://github.com/postgres/postgres/commit/d5d46d99ba47f https://github.com/postgres/postgres/commit/b6e39ca92eeee4 https://github.com/postgres/postgres/commit/f1cda6d6cbb2 https://security.archlinux.org/CVE-2017-7546 https://security.archlinux.org/CVE-2017-7547 https://security.archlinux.org/CVE-2017-7548

1 0

[arch-security] [ASA-201709-1] chromium: multiple issues
by Remi Gacogne 06 Sep '17

06 Sep '17

Arch Linux Security Advisory ASA-201709-1 ========================================= Severity: Critical Date : 2017-09-06 CVE-ID : CVE-2017-5111 CVE-2017-5112 CVE-2017-5113 CVE-2017-5114 CVE-2017-5115 CVE-2017-5116 CVE-2017-5117 CVE-2017-5118 CVE-2017-5119 CVE-2017-5120 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-391 Summary ======= The package chromium before version 61.0.3163.79-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and silent downgrade. Resolution ========== Upgrade to 61.0.3163.79-1. # pacman -Syu "chromium>=61.0.3163.79-1" The problems have been fixed upstream in version 61.0.3163.79. Workaround ========== None. Description =========== - CVE-2017-5111 (arbitrary code execution) A use-after-free vulnerability has been found in the PDFium component of the Chromium browser < 61.0.3163.79. - CVE-2017-5112 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the WebGL component of the Chromium browser < 61.0.3163.79. - CVE-2017-5113 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the Skia component of the Chromium browser < 61.0.3163.79. - CVE-2017-5114 (arbitrary code execution) A memory lifecycle vulnerability has been found in the PDFium component of the Chromium browser < 61.0.3163.79. - CVE-2017-5115 (arbitrary code execution) A type confusion vulnerability has been found in the V8 component of the Chromium browser < 61.0.3163.79. - CVE-2017-5116 (arbitrary code execution) A type confusion vulnerability has been found in the V8 component of the Chromium browser < 61.0.3163.79. - CVE-2017-5117 (information disclosure) A use of initialized value issue has been found in the Skia component of the Chromium browser < 61.0.3163.79. - CVE-2017-5118 (access restriction bypass) A content security policy bypass vulnerability has been found in the Blink component of the Chromium browser < 61.0.3163.79. - CVE-2017-5119 (information disclosure) A use of initialized value issue has been found in the Skia component of the Chromium browser < 61.0.3163.79. - CVE-2017-5120 (silent downgrade) A potential issue leading to HTTPS downgrade during redirect navigation has been found in the Chromium browser < 61.0.3163.79. Impact ====== A remote attacker can access sensitive information, bypass the content security policy, force a downgrade from HTTPS to HTTP and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=737023 https://bugs.chromium.org/p/chromium/issues/detail?id=740603 https://bugs.chromium.org/p/chromium/issues/detail?id=747043 https://bugs.chromium.org/p/chromium/issues/detail?id=752829 https://bugs.chromium.org/p/chromium/issues/detail?id=744584 https://bugs.chromium.org/p/chromium/issues/detail?id=759624 https://bugs.chromium.org/p/chromium/issues/detail?id=739190 https://bugs.chromium.org/p/chromium/issues/detail?id=747847 https://bugs.chromium.org/p/chromium/issues/detail?id=725127 https://bugs.chromium.org/p/chromium/issues/detail?id=718676 https://security.archlinux.org/CVE-2017-5111 https://security.archlinux.org/CVE-2017-5112 https://security.archlinux.org/CVE-2017-5113 https://security.archlinux.org/CVE-2017-5114 https://security.archlinux.org/CVE-2017-5115 https://security.archlinux.org/CVE-2017-5116 https://security.archlinux.org/CVE-2017-5117 https://security.archlinux.org/CVE-2017-5118 https://security.archlinux.org/CVE-2017-5119 https://security.archlinux.org/CVE-2017-5120

1 0