January 2018 - Arch-security - lists.archlinux.org

[ASA-201801-22] lib32-curl: multiple issues
by Jelle van der Waa 30 Jan '18

30 Jan '18

Arch Linux Security Advisory ASA-201801-22 ========================================== Severity: Medium Date : 2018-01-29 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-594 Summary ======= The package lib32-curl before version 7.58.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.58.0-1. # pacman -Syu "lib32-curl>=7.58.0-1" The problems have been fixed upstream in version 7.58.0. Workaround ========== None. Description =========== - CVE-2018-1000005 (denial of service) libcurl contains an out bounds read in code handling HTTP/2 trailers. It was reported that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `":"` to the target buffer, while this was recently changed to `": "` (a space was added after the colon) but the associated math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to the libcurl callback. This might lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something. - CVE-2018-1000007 (information disclosure) libcurl might leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequest hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-824a.html https://github.com/curl/curl/commit/fa3dbb9a147488a2943bda809c66fc497efe06cb https://curl.haxx.se/docs/adv_2018-b3bf.html https://github.com/curl/curl/commit/af32cd3859336ab963591ca0df9b1e33a7ee066b https://security.archlinux.org/CVE-2018-1000005 https://security.archlinux.org/CVE-2018-1000007

1 0

[ASA-201801-21] rsync: multiple issues
by Jelle van der Waa 30 Jan '18

30 Jan '18

Arch Linux Security Advisory ASA-201801-21 ========================================== Severity: High Date : 2018-01-29 CVE-ID : CVE-2017-16548 CVE-2017-17433 CVE-2017-17434 CVE-2018-5764 Package : rsync Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-542 Summary ======= The package rsync before version 3.1.3pre1-1 is vulnerable to multiple issues including access restriction bypass and denial of service. Resolution ========== Upgrade to 3.1.3pre1-1. # pacman -Syu "rsync>=3.1.3pre1-1" The problems have been fixed upstream in version 3.1.3pre1. Workaround ========== None. Description =========== - CVE-2017-16548 (denial of service) The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon. - CVE-2017-17433 (access restriction bypass) The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-11-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions. - CVE-2017-17434 (access restriction bypass) The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions. - CVE-2018-5764 (access restriction bypass) The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism. Impact ====== A remote attacker is able to bypass access restrictions or cause a denial of service by sending a maliciously crafted request to rsyncd. References ========== https://bugs.archlinux.org/task/57111 https://git.samba.org/?p=rsync.git;a=commitdiff;h=47a63d90e71d3e19e0e96052b… https://git.samba.org/?p=rsync.git;a=commitdiff;h=3e06d40029cfdce9d0f73d87c… https://git.samba.org/?p=rsync.git;a=commitdiff;h=5509597decdbd7b91994210f7… https://git.samba.org/?p=rsync.git;a=commitdiff;h=70aeb5fddd1b2f8e143276f8d… https://git.samba.org/?p=rsync.git;a=commitdiff;h=7706303828fcde524222babb2… https://security.archlinux.org/CVE-2017-16548 https://security.archlinux.org/CVE-2017-17433 https://security.archlinux.org/CVE-2017-17434 https://security.archlinux.org/CVE-2018-5764

1 0

[ASA-201801-20] curl: multiple issues
by Jelle van der Waa 29 Jan '18

29 Jan '18

Arch Linux Security Advisory ASA-201801-20 ========================================== Severity: Medium Date : 2018-01-28 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-593 Summary ======= The package curl before version 7.58.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.58.0-1. # pacman -Syu "curl>=7.58.0-1" The problems have been fixed upstream in version 7.58.0. Workaround ========== None. Description =========== - CVE-2018-1000005 (denial of service) libcurl contains an out bounds read in code handling HTTP/2 trailers. It was reported that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `":"` to the target buffer, while this was recently changed to `": "` (a space was added after the colon) but the associated math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to the libcurl callback. This might lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something. - CVE-2018-1000007 (information disclosure) libcurl might leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequest hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-824a.html https://github.com/curl/curl/commit/fa3dbb9a147488a2943bda809c66fc497efe06cb https://curl.haxx.se/docs/adv_2018-b3bf.html https://github.com/curl/curl/commit/af32cd3859336ab963591ca0df9b1e33a7ee066b https://security.archlinux.org/CVE-2018-1000005 https://security.archlinux.org/CVE-2018-1000007

1 0

[ASA-201801-19] lib32-glibc: privilege escalation
by Jelle van der Waa 29 Jan '18

29 Jan '18

Arch Linux Security Advisory ASA-201801-19 ========================================== Severity: High Date : 2018-01-28 CVE-ID : CVE-2018-1000001 Package : lib32-glibc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-590 Summary ======= The package lib32-glibc before version 2.26-11 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.26-11. # pacman -Syu "lib32-glibc>=2.26-11" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A buffer underflow vulnerability has been discovered in the realpath() function in glibc 2.26 when getcwd() returns a relative or unreachable path (i.e. not starting with '/') which may allow privilege escalation under certain conditions. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== http://www.openwall.com/lists/oss-security/2018/01/11/5 https://sourceware.org/bugzilla/show_bug.cgi?id=22679 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=52a713fdd0a30e1bd79818e… https://security.archlinux.org/CVE-2018-1000001

1 0

[ASA-201801-18] glibc: privilege escalation
by Jelle van der Waa 29 Jan '18

29 Jan '18

Arch Linux Security Advisory ASA-201801-18 ========================================== Severity: High Date : 2018-01-28 CVE-ID : CVE-2018-1000001 Package : glibc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-590 Summary ======= The package glibc before version 2.26-11 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.26-11. # pacman -Syu "glibc>=2.26-11" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A buffer underflow vulnerability has been discovered in the realpath() function in glibc 2.26 when getcwd() returns a relative or unreachable path (i.e. not starting with '/') which may allow privilege escalation under certain conditions. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== http://www.openwall.com/lists/oss-security/2018/01/11/5 https://sourceware.org/bugzilla/show_bug.cgi?id=22679 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=52a713fdd0a30e1bd79818e… https://security.archlinux.org/CVE-2018-1000001

1 0

[ASA-201801-17] zziplib: denial of service
by Levente Polyak 28 Jan '18

28 Jan '18

Arch Linux Security Advisory ASA-201801-17 ========================================== Severity: Medium Date : 2018-01-18 CVE-ID : CVE-2017-5977 CVE-2017-5978 Package : zziplib Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-273 Summary ======= The package zziplib before version 0.13.67-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.13.67-1. # pacman -Syu "zziplib>=0.13.67-1" The problems have been fixed upstream in version 0.13.67. Workaround ========== None. Description =========== - CVE-2017-5977 (denial of service) The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file. - CVE-2017-5978 (denial of service) The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file. Impact ====== A remote attacker is able to use a specially crafted zip archive to crash the application. References ========== https://bugs.archlinux.org/task/53133 http://www.openwall.com/lists/oss-security/2017/02/14/3 https://blogs.gentoo.org/ago/2017/02/09/zziplib-invalid-memory-read-in-zzip… https://github.com/gdraheim/zziplib/commit/9e8f867a976311a3e5fb0184c947e22e… https://github.com/gdraheim/zziplib/commit/1e5b1ac48186e34e871945769623becf… https://github.com/gdraheim/zziplib/issues/3 https://blogs.gentoo.org/ago/2017/02/09/zziplib-out-of-bounds-read-in-zzip_… https://github.com/gdraheim/zziplib/commit/98403bb3c0661e56a2185777fd244ba3… https://security.archlinux.org/CVE-2017-5977 https://security.archlinux.org/CVE-2017-5978

1 0

[ASA-201801-16] bind: denial of service
by Levente Polyak 19 Jan '18

19 Jan '18

Arch Linux Security Advisory ASA-201801-16 ========================================== Severity: High Date : 2018-01-18 CVE-ID : CVE-2017-3145 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-589 Summary ======= The package bind before version 9.11.2.P1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.2.P1-1. # pacman -Syu "bind>=9.11.2.P1-1" The problem has been fixed upstream in version 9.11.2.P1. Workaround ========== None. Description =========== A use-after-free flaw leading to denial of service was found in the way BIND before 9.11.2.P1, 9.10.6-P1 and 9.9.11-P1 internally handled cleanup operations on upstream recursion fetch contexts. A remote attacker could potentially use this flaw to make named, acting as a DNSSEC validating resolver, exit unexpectedly with an assertion failure via a specially crafted DNS request. Impact ====== A remote attacker is able to crash named while acting as a DNSSEC validating resolver via a specially crafted DNS request. References ========== https://kb.isc.org/article/AA-01542 https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=053b51… https://security.archlinux.org/CVE-2017-3145

1 0

[ASA-201801-15] perl-xml-libxml: arbitrary code execution
by Levente Polyak 19 Jan '18

19 Jan '18

Arch Linux Security Advisory ASA-201801-15 ========================================== Severity: High Date : 2018-01-18 CVE-ID : CVE-2017-10672 Package : perl-xml-libxml Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-501 Summary ======= The package perl-xml-libxml before version 2.0130-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.0130-1. # pacman -Syu "perl-xml-libxml>=2.0130-1" The problem has been fixed upstream in version 2.0130. Workaround ========== None. Description =========== A use-after-free vulnerability has been discovered in the perl XML- LibXML module before 2.0130 which allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call. Impact ====== A remote attacker is able to execute arbitrary code on the affected host by controlling the arguments to a replaceChild call. References ========== https://bugs.archlinux.org/task/56377 https://rt.cpan.org/Public/Bug/Display.html?id=122246 https://security.archlinux.org/CVE-2017-10672

1 0

[ASA-201801-14] nrpe: arbitrary command execution
by Levente Polyak 19 Jan '18

19 Jan '18

Arch Linux Security Advisory ASA-201801-14 ========================================== Severity: High Date : 2018-01-18 CVE-ID : CVE-2013-1362 CVE-2014-2913 Package : nrpe Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-587 Summary ======= The package nrpe before version 3.2.1-3 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.2.1-3. # pacman -Syu "nrpe>=3.2.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== Ensure the "dont_blame_nrpe" option in nrpe.conf is disabled. Description =========== - CVE-2013-1362 (arbitrary command execution) Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash. - CVE-2014-2913 (arbitrary command execution) Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. Impact ====== A remote attacker is able to execute arbitrary commands on the affected host by passing malicious command arguments via check_nrpe. References ========== https://bugs.archlinux.org/task/57120 http://seclists.org/bugtraq/2013/Feb/119 https://github.com/NagiosEnterprises/nrpe/commit/eaaebb3c2925f9aee74319b612… http://seclists.org/fulldisclosure/2014/Apr/240 http://seclists.org/oss-sec/2014/q2/154 https://security.archlinux.org/CVE-2013-1362 https://security.archlinux.org/CVE-2014-2913

1 0

[ASA-201801-13] transmission-cli: arbitrary command execution
by Levente Polyak 19 Jan '18

19 Jan '18

Arch Linux Security Advisory ASA-201801-13 ========================================== Severity: High Date : 2018-01-17 CVE-ID : CVE-2018-5702 Package : transmission-cli Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-588 Summary ======= The package transmission-cli before version 2.92-8 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2.92-8. # pacman -Syu "transmission-cli>=2.92-8" The problem has been fixed upstream but no release is available yet. Workaround ========== Enable authentication in the transmission-daemon using a strong password. Description =========== The transmission-daemon in Transmission before 2.93 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack. Impact ====== A remote attacker is able to execute arbitrary RPC commands and consequently write to arbitrary files by tricking a user into visiting a malicious website. References ========== https://bugs.archlinux.org/task/57086 http://www.openwall.com/lists/oss-security/2018/01/12/1 https://bugs.chromium.org/p/project-zero/issues/detail?id=1447 https://github.com/transmission/transmission/commit/eb5d1a79cbe1b9bc5b22fdc… https://github.com/transmission/transmission/pull/468 https://security.archlinux.org/CVE-2018-5702

1 0