March 2018 - Arch-security - lists.archlinux.org

[ASA-201803-14] clamav: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-14 ========================================== Severity: Critical Date : 2018-03-18 CVE-ID : CVE-2012-6706 CVE-2017-6419 CVE-2017-11423 CVE-2018-0202 CVE-2018-1000085 Package : clamav Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-602 Summary ======= The package clamav before version 0.99.4-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.99.4-1. # pacman -Syu "clamav>=0.99.4-1" The problems have been fixed upstream in version 0.99.4. Workaround ========== None. Description =========== - CVE-2012-6706 (arbitrary code execution) A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos]. - CVE-2017-6419 (arbitrary code execution) mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV before 0.99.4, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code via a crafted CHM file. - CVE-2017-11423 (denial of service) The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV before 0.99.4 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. - CVE-2018-0202 (arbitrary code execution) A heap overflow has been discovered in ClamAv before 0.99.4 in pdf_parse_string possibly leading to arbitrary code execution by inspecting a specially crafted PDF file. - CVE-2018-1000085 (denial of service) A heap-based out-of-bounds read has been found in the xar_hash_check function of the xar decoder of ClamAV before 0.99.4, leading to a denial of service. Impact ====== A remote attacker can cause a denial of service or execute arbitrary code on the affected host by submitting a crafted file for inspection by ClamAV. References ========== http://www.openwall.com/lists/oss-security/2017/06/21/9 https://bugs.chromium.org/p/project-zero/issues/detail?id=1286 https://github.com/Cisco-Talos/clamav-devel/commit/d4699442bce76574573dc564… https://bugzilla.clamav.net/show_bug.cgi?id=11701 https://github.com/Cisco-Talos/clamav-devel/commit/a83773682e856ad6529ba6db… https://github.com/kyz/libmspack/commit/6139a0b9e93fcb7fcf423e56aa825bc869e… https://bugzilla.clamav.net/show_bug.cgi?id=11873 https://github.com/kyz/libmspack/commit/17038206fcc384dcee6dd9e3a75f08fd3dd… https://github.com/Cisco-Talos/clamav-devel/commit/ffa31264a657618a0e40c51c… https://github.com/Cisco-Talos/clamav-devel/commit/ada5f94e5cfb04e1ac2a6f38… https://github.com/hackerlib/hackerlib-vul/tree/master/clamav-vul https://bugzilla.clamav.net/show_bug.cgi?id=11973 https://bugzilla.clamav.net/show_bug.cgi?id=11980 https://github.com/Cisco-Talos/clamav-devel/commit/87aaa10b29476958f5bf54b6… https://github.com/Cisco-Talos/clamav-devel/commit/700ed96af56077cb1a9bff7b… https://github.com/Cisco-Talos/clamav-devel/commit/0df2fedf2805e574512c486b… https://github.com/Cisco-Talos/clamav-devel/commit/495fce917445063d519f14b0… https://github.com/Cisco-Talos/clamav-devel/commit/99eadf7a9ad3512101653123… http://www.openwall.com/lists/oss-security/2017/09/29/4 https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e387620… https://bugzilla.clamav.net/show_bug.cgi?id=11588 https://security.archlinux.org/CVE-2012-6706 https://security.archlinux.org/CVE-2017-6419 https://security.archlinux.org/CVE-2017-11423 https://security.archlinux.org/CVE-2018-0202 https://security.archlinux.org/CVE-2018-1000085

1 0

[ASA-201803-13] firefox: arbitrary code execution
by Jelle van der Waa 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-13 ========================================== Severity: Critical Date : 2018-03-18 CVE-ID : CVE-2018-5146 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-657 Summary ======= The package firefox before version 59.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 59.0.1-1. # pacman -Syu "firefox>=59.0.1-1" The problem has been fixed upstream in version 59.0.1. Workaround ========== None. Description =========== An out of bounds memory write vulnerability has been discovered in libvorbis before 1.3.6 while processing Vorbis audio data related to codebooks that are not an exact divisor of the partition size. Impact ====== A remote attacker is able to execute arbitrary code by tricking the user into visiting a website with a vorbis audio file. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/#CVE-2018-5146 https://bugzilla.mozilla.org/show_bug.cgi?id=1446062 https://github.com/xiph/vorbis/commit/667ceb4aab60c1f74060143bb24e5f427b3cc… http://seclists.org/oss-sec/2018/q1/243 https://security.archlinux.org/CVE-2018-5146

1 0

[ASA-201803-12] libvorbis: multiple issues
by Jelle van der Waa 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-12 ========================================== Severity: Critical Date : 2018-03-16 CVE-ID : CVE-2017-14632 CVE-2017-14633 CVE-2018-5146 Package : libvorbis Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-367 Summary ======= The package libvorbis before version 1.3.6-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.3.6-1. # pacman -Syu "libvorbis>=1.3.6-1" The problems have been fixed upstream in version 1.3.6. Workaround ========== None. Description =========== - CVE-2017-14632 (arbitrary code execution) fXiph.Org libvorbis before 1.3.6 allows remote code execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. - CVE-2017-14633 (denial of service) In Xiph.Org libvorbis before 1.3.6, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). - CVE-2018-5146 (arbitrary code execution) An out of bounds memory write vulnerability has been discovered in libvorbis before 1.3.6 while processing Vorbis audio data related to codebooks that are not an exact divisor of the partition size. Impact ====== A remote attacker is able to execute arbitrary code or crash the application by tricking the user into playing a specially crafted vorbis file. References ========== https://github.com/xiph/vorbis/commit/c1c2831fc7306d5fbd7bc800324efd12b28d3… https://github.com/xiph/vorbis/commit/a79ec216cd119069c68b8f3542c6a425a74ab… https://github.com/xiph/vorbis/commit/667ceb4aab60c1f74060143bb24e5f427b3cc… http://seclists.org/oss-sec/2018/q1/243 https://security.archlinux.org/CVE-2017-14632 https://security.archlinux.org/CVE-2017-14633 https://security.archlinux.org/CVE-2018-5146

1 0

[ASA-201803-11] ntp: multiple issues
by Remi Gacogne 18 Mar '18

18 Mar '18

Arch Linux Security Advisory ASA-201803-11 ========================================== Severity: High Date : 2018-03-16 CVE-ID : CVE-2016-1549 CVE-2018-7170 CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185 Package : ntp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-647 Summary ======= The package ntp before version 4.2.8.p11-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and denial of service. Resolution ========== Upgrade to 4.2.8.p11-1. # pacman -Syu "ntp>=4.2.8.p11-1" The problems have been fixed upstream in version 4.2.8.p11. Workaround ========== None. Description =========== - CVE-2016-1549 (content spoofing) A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock. - CVE-2018-7170 (content spoofing) ntpd can be vulnerable to Sybil attacks. If a system is set up to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer -- i.e. one where the attacker knows the private symmetric key -- can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock. - CVE-2018-7182 (denial of service) ctl_getitem() is used by ntpd to process incoming mode 6 packets. A malicious mode 6 packet can be sent to an ntpd instance, and if the ntpd instance is from 4.2.8p6 thru 4.2.8p10, that will cause ctl_getitem() to read past the end of its buffer. - CVE-2018-7183 (arbitrary code execution) ntpq is a monitoring and control program for ntpd. decodearr() is an internal function of ntpq that is used to -- wait for it -- decode an array in a response string when formatted data is being displayed. This is a problem in affected versions of ntpq if a maliciously-altered ntpd returns an array result that will trip this bug, or if a bad actor is able to read an ntpq request on its way to a remote ntpd server and forge and send a response before the remote ntpd sends its response. It's potentially possible that the malicious data could become injectable/executable code. - CVE-2018-7184 (denial of service) The fix for NtpBug2952 was incomplete, and while it fixed one problem it created another. Specifically, it drops bad packets before updating the "received" timestamp. This means a third-party can inject a packet with a zero-origin timestamp, meaning the sender wants to reset the association, and the transmit timestamp in this bogus packet will be saved as the most recent "received" timestamp. The real remote peer does not know this value and this will disrupt the association until the association resets. - CVE-2018-7185 (denial of service) The NTP Protocol allows for both non-authenticated and authenticated associations, in client/server, symmetric (peer), and several broadcast modes. In addition to the basic NTP operational modes, symmetric mode and broadcast servers can support an interleaved mode of operation. In ntp-4.2.8p4 a bug was inadvertently introduced into the protocol engine that allows a non-authenticated zero-origin (reset) packet to reset an authenticated interleaved peer association. If an attacker can send a packet with a zero-origin timestamp and the source IP address of the "other side" of an interleaved association, the 'victim' ntpd will reset its association. The attacker must continue sending these packets in order to maintain the disruption of the association. In ntp-4.0.0 thru ntp-4.2.8p6, interleave mode could be entered dynamically. As of ntp-4.2.8p7, interleaved mode must be explicitly configured/enabled. Impact ====== A remote, non-authenticated peer can cause a denial of service, preventing the vulnerable host from getting a correct time. In addition to that, a remote, authenticated peer can spoof the correct time, causing the vulnerable host to update its clock with an invalid time. A malicious NTPd server, or an attacker in position of man-in-the- middle might be able to execute arbitrary code on the affected host by forging a response to an ntpq request. References ========== http://support.ntp.org/bin/view/Main/NtpBug3012 http://support.ntp.org/bin/view/Main/NtpBug3415 http://support.ntp.org/bin/view/Main/NtpBug3412 http://support.ntp.org/bin/view/Main/NtpBug3414 http://support.ntp.org/bin/view/Main/NtpBug3453 http://support.ntp.org/bin/view/Main/NtpBug3454 https://security.archlinux.org/CVE-2016-1549 https://security.archlinux.org/CVE-2018-7170 https://security.archlinux.org/CVE-2018-7182 https://security.archlinux.org/CVE-2018-7183 https://security.archlinux.org/CVE-2018-7184 https://security.archlinux.org/CVE-2018-7185

1 0

[ASA-201803-10] samba: multiple issues
by Jelle van der Waa 14 Mar '18

14 Mar '18

Arch Linux Security Advisory ASA-201803-10 ========================================== Severity: Critical Date : 2018-03-13 CVE-ID : CVE-2018-1050 CVE-2018-1057 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-651 Summary ======= The package samba before version 4.7.6-1 is vulnerable to multiple issues including access restriction bypass and denial of service. Resolution ========== Upgrade to 4.7.6-1. # pacman -Syu "samba>=4.7.6-1" The problems have been fixed upstream in version 4.7.6. Workaround ========== - CVE-2018-1050 Ensure the parameter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf. - CVE-2018-1057 Revoke the change passwords right for 'the world' from all user objects (including computers) in the directory, leaving only the right to change a user's own password. Description =========== - CVE-2018-1050 (denial of service) All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash. - CVE-2018-1057 (access restriction bypass) On a Samba 4 AD DC any authenticated user can change other users' passwords over LDAP, including the passwords of administrative users and service accounts. Impact ====== A remote attacker is able to change other users passwords on a Samba 4 AD DC or perform a denial of service attack by sending a specially crafted request to the spoolss service. References ========== https://lists.samba.org/archive/samba-announce/2018/000435.html https://www.samba.org/samba/security/CVE-2018-1050.html https://github.com/samba-team/samba/commit/c41895be8222199ffe69749e32afc994… https://www.samba.org/samba/security/CVE-2018-1057.html https://wiki.samba.org/index.php/CVE-2018-1057 https://github.com/samba-team/samba/commit/50e7788603b97104fe116a07ab14a1d1… https://github.com/samba-team/samba/commit/c80456855197f9fe9ef497a7fc94504c… https://github.com/samba-team/samba/commit/ab7dc210e9aedc1222055822ff296e4a… https://github.com/samba-team/samba/commit/407a34c73fcd666c22776bbc4aa56d02… https://github.com/samba-team/samba/commit/3e6621fe58014f19477633b1c0b54288… https://github.com/samba-team/samba/commit/9dd7dd9ebba8d449feea66695fab3cbb… https://github.com/samba-team/samba/commit/766ab4c52b06532f2dd8801ccf5d4aad… https://github.com/samba-team/samba/commit/0e15ce12e1e9733f1e8eb13e77cbcdd0… https://github.com/samba-team/samba/commit/39e689aa703536330083bfc4d58d15a2… https://github.com/samba-team/samba/commit/2fea9ee701fed0417d8f681238663b7b… https://github.com/samba-team/samba/commit/c653e51a3d991e0e08327186881b324b… https://github.com/samba-team/samba/commit/b23bf04caeb196da9515addbcdf17db0… https://github.com/samba-team/samba/commit/fbd16473ecf073f86e36f9e29a801512… https://security.archlinux.org/CVE-2018-1050 https://security.archlinux.org/CVE-2018-1057

1 0

[ASA-201803-9] postgresql: privilege escalation
by Jelle van der Waa 14 Mar '18

14 Mar '18

Arch Linux Security Advisory ASA-201803-9 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-1058 Package : postgresql Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-643 Summary ======= The package postgresql before version 10.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 10.3-1. # pacman -Syu "postgresql>=10.3-1" The problem has been fixed upstream in version 10.3. Workaround ========== None. Description =========== A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected. Impact ====== A remote attacker with a valid user account is able to execute code with permissions of a superuser of the database. References ========== https://www.postgresql.org/about/news/1834/ https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Sea… https://security.archlinux.org/CVE-2018-1058

1 0

[ASA-201803-8] calibre: arbitrary command execution
by Jelle van der Waa 13 Mar '18

13 Mar '18

Arch Linux Security Advisory ASA-201803-8 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-7889 Package : calibre Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-650 Summary ======= The package calibre before version 3.19.0-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.19.0-1. # pacman -Syu "calibre>=3.19.0-1" The problem has been fixed upstream in version 3.19.0. Workaround ========== None. Description =========== gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call. Impact ====== A remote attacker is able to execute arbitrary commands by tricking the user into importing a specially crafted bookmark. References ========== https://bugs.launchpad.net/calibre/+bug/1753870 https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf657951756688b3c72b… https://security.archlinux.org/CVE-2018-7889

1 0

[ASA-201803-7] dovecot: multiple issues
by Jelle van der Waa 13 Mar '18

13 Mar '18

Arch Linux Security Advisory ASA-201803-7 ========================================= Severity: High Date : 2018-03-06 CVE-ID : CVE-2017-14461 CVE-2017-15130 CVE-2017-15132 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-645 Summary ======= The package dovecot before version 2.3.0.1-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.3.0.1-1. # pacman -Syu "dovecot>=2.3.0.1-1" The problems have been fixed upstream in version 2.3.0.1. Workaround ========== None. Description =========== - CVE-2017-14461 (information disclosure) A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure of an email from another user or may cause an application crash. In order to trigger this vulnerability, an imap-authenticated attacker needs to send a specially crafted email message to the server. - CVE-2017-15130 (denial of service) A denial of service flaw was found in dovecot before 2.2.34 and 2.3.0.1. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage, causing imap-login/pop3-login VSZ limit to be reached and the process restarted. This happens only if Dovecot config has local_name { } or local { } configuration blocks and attacker uses randomly generated SNI servernames. - CVE-2017-15132 (denial of service) A flaw was found in dovecot before 2.2.34 and 2.3.0.1. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion. Impact ====== A remote attacker is able to crash the application or disclose information by sending a specially crafted email. References ========== https://www.dovecot.org/list/dovecot-news/2018-February/000371.html https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510 https://github.com/dovecot/core/commit/30dc856f7b97b75b0e0d69f5003d5d99a132… https://github.com/dovecot/core/commit/8d65e2345e1dbedb00b662ee0abd05be2e7e… https://github.com/dovecot/core/commit/b72d864b8c34cb21076214c0b28101baec53… https://github.com/dovecot/core/commit/e9b86842441a668b30796bff7d6082861457… https://github.com/dovecot/core/commit/f5cd17a27f0b666567747f8c921ebe102697… https://github.com/dovecot/core/commit/18a7a161c8dae6f630770a3cbab7374a0c3d… https://github.com/dovecot/core/commit/0ed696987e5e5d44e971da2a10f6275b276e… https://www.dovecot.org/list/dovecot-news/2018-February/000370.html https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8… https://security.archlinux.org/CVE-2017-14461 https://security.archlinux.org/CVE-2017-15130 https://security.archlinux.org/CVE-2017-15132

1 0

[ASA-201803-6] python2-django: denial of service
by Jelle van der Waa 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-6 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python2-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package python2-django before version 1.11.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.11-1. # pacman -Syu "python2-django>=1.11.11-1" The problems have been fixed upstream in version 1.11.11. Workaround ========== None. Description =========== - CVE-2018-7536 (denial of service) The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. - CVE-2018-7537 (denial of service) If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. Impact ====== A remote attacker is able to crash the application by providing specially crafted input. References ========== https://docs.djangoproject.com/en/dev/releases/1.11.11/ https://github.com/django/django/commit/8618271caa0b09daba39ff3b46567d33ae1… https://github.com/django/django/commit/97b7dd59bb8d6163239061e2022153c3415… https://security.archlinux.org/CVE-2018-7536 https://security.archlinux.org/CVE-2018-7537

1 1

[ASA-201803-5] python-django: denial of service
by Jelle van der Waa 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-5 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package python-django before version 1.11.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.11-1. # pacman -Syu "python-django>=1.11.11-1" The problems have been fixed upstream in version 1.11.11. Workaround ========== None. Description =========== - CVE-2018-7536 (denial of service) The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. - CVE-2018-7537 (denial of service) If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. Impact ====== A remote attacker is able to crash the application by providing specially crafted input. References ========== https://docs.djangoproject.com/en/dev/releases/1.11.11/ https://github.com/django/django/commit/8618271caa0b09daba39ff3b46567d33ae1… https://github.com/django/django/commit/97b7dd59bb8d6163239061e2022153c3415… https://security.archlinux.org/CVE-2018-7536 https://security.archlinux.org/CVE-2018-7537

1 0