April 2018 - Arch-security - lists.archlinux.org

[ASA-201804-10] drupal: arbitrary command execution
by Jelle van der Waa 29 Apr '18

29 Apr '18

Arch Linux Security Advisory ASA-201804-10 ========================================== Severity: Critical Date : 2018-04-27 CVE-ID : CVE-2018-7602 Package : drupal Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-679 Summary ======= The package drupal before version 8.5.3-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 8.5.3-1. # pacman -Syu "drupal>=8.5.3-1" The problem has been fixed upstream in version 8.5.3. Workaround ========== None. Description =========== A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. Impact ====== A remote attacker is able to execute arbitrary code by performing a specially crafted request. References ========== https://www.drupal.org/sa-core-2018-004 https://github.com/drupal/drupal/commit/bb6d396609600d1169da29456ba3db59aba… https://security.archlinux.org/CVE-2018-7602

1 0

[ASA-201804-9] xfig: information disclosure
by Jelle van der Waa 23 Apr '18

23 Apr '18

Arch Linux Security Advisory ASA-201804-9 ========================================= Severity: Medium Date : 2018-04-19 CVE-ID : CVE-2017-16899 Package : xfig Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-513 Summary ======= The package xfig before version 3.2.7-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 3.2.7-1. # pacman -Syu "xfig>=3.2.7-1" The problem has been fixed upstream in version 3.2.7. Workaround ========== None. Description =========== An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881143 https://security.archlinux.org/CVE-2017-16899

1 0

[ASA-201804-8] roundcubemail: arbitrary command execution
by Jelle van der Waa 23 Apr '18

23 Apr '18

Arch Linux Security Advisory ASA-201804-8 ========================================= Severity: High Date : 2018-04-19 CVE-ID : CVE-2018-9846 Package : roundcubemail Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-670 Summary ======= The package roundcubemail before version 1.3.6-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.3.6-1. # pacman -Syu "roundcubemail>=1.3.6-1" The problem has been fixed upstream in version 1.3.6. Workaround ========== Disable the archive plugin. Description =========== In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user- controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism. Impact ====== A remote attacker is able to execute arbitrary IMAP commands via a specially crafted url. References ========== https://github.com/roundcube/roundcubemail/issues/6229 https://github.com/roundcube/roundcubemail/issues/6238 https://medium.com/@ndrbasi/cve-2018-9846-roundcube-303097048b0a https://roundcube.net/news/2018/04/11/security-update-1.3.6 https://security.archlinux.org/CVE-2018-9846

1 0

[ASA-201804-7] zsh: denial of service
by Jelle van der Waa 23 Apr '18

23 Apr '18

Arch Linux Security Advisory ASA-201804-7 ========================================= Severity: Medium Date : 2018-04-19 CVE-ID : CVE-2018-7548 CVE-2018-7549 Package : zsh Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-642 Summary ======= The package zsh before version 5.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.5-1. # pacman -Syu "zsh>=5.5-1" The problems have been fixed upstream in version 5.5. Workaround ========== None. Description =========== - CVE-2018-7548 (denial of service) In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result. - CVE-2018-7549 (denial of service) In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. Impact ====== A local attacker can cause a denial of service via a specially input. References ========== https://sourceforge.net/p/zsh/code/ci/110b13e1090bc31ac1352b28adc2d02b6d25a… https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec43… https://security.archlinux.org/CVE-2018-7548 https://security.archlinux.org/CVE-2018-7549

1 0

[ASA-201804-6] lib32-openssl: private key recovery
by Remi Gacogne 15 Apr '18

15 Apr '18

Arch Linux Security Advisory ASA-201804-6 ========================================= Severity: Medium Date : 2018-04-15 CVE-ID : CVE-2017-3738 Package : lib32-openssl Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-551 Summary ======= The package lib32-openssl before version 1:1.1.0.h-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1:1.1.0.h-1. # pacman -Syu "lib32-openssl>=1:1.1.0.h-1" The problem has been fixed upstream in version 1.1.0.h. Workaround ========== None. Description =========== There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. Impact ====== A remote attacker might be able to recover a private key (in very unlikely cases). References ========== https://www.openssl.org/news/vulnerabilities.html#2017-3738 https://www.openssl.org/news/secadv/20171207.txt https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f… https://security.archlinux.org/CVE-2017-3738

1 0

[ASA-201804-5] zsh: arbitrary code execution
by Remi Gacogne 15 Apr '18

15 Apr '18

Arch Linux Security Advisory ASA-201804-5 ========================================= Severity: High Date : 2018-04-11 CVE-ID : CVE-2018-1100 Package : zsh Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-669 Summary ======= The package zsh before version 5.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.5-1. # pacman -Syu "zsh>=5.5-1" The problem has been fixed upstream in version 5.5. Workaround ========== None. Description =========== A stack-based buffer overflow has been found in zsh <= 5.4.2, in the checkmailpath() function, where unchecked strings from the MAILCHECK variable are copied to a buffer. A local, unprivileged user can create a specially crafted message file, which, if used to set a custom "you have new mail" message, leads to code execution in the context of the user who receives the message. If the user affected is privileged, this leads to privilege escalation. Impact ====== A local attacker might be able to execute arbitrary code in the context of another user. References ========== https://www.zsh.org/mla/workers/2018/msg00411.html https://sourceforge.net/p/zsh/code/ci/31f72205630687c1cef89347863aab355296a… https://security.archlinux.org/CVE-2018-1100

1 0

[ASA-201804-4] apache: multiple issues
by Santiago Torres-Arias 12 Apr '18

12 Apr '18

Arch Linux Security Advisory ASA-201804-4 ========================================= Severity: Medium Date : 2018-04-04 CVE-ID : CVE-2017-15710 CVE-2017-15715 CVE-2018-1283 CVE-2018-1301 CVE-2018-1302 CVE-2018-1303 CVE-2018-1312 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-664 Summary ======= The package apache before version 2.4.33-1 is vulnerable to multiple issues including session hijacking, access restriction bypass, content spoofing and denial of service. Resolution ========== Upgrade to 2.4.33-1. # pacman -Syu "apache>=2.4.33-1" The problems have been fixed upstream in version 2.4.33. Workaround ========== None. Description =========== - CVE-2017-15710 (denial of service) In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en- US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all. - CVE-2017-15715 (access restriction bypass) In Apache httpd 2.4.0 before 2.4.30, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename. - CVE-2018-1283 (session hijacking) In Apache httpd 2.2.0 before 2.4.30, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. - CVE-2018-1301 (denial of service) A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage. - CVE-2018-1302 (denial of service) When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk. - CVE-2018-1303 (denial of service) A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. - CVE-2018-1312 (content spoofing) In Apache httpd 2.2.0 before 2.4.30, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection. Impact ====== A remote attacker is able to crash a server, hijack a user session, upload arbitrary files or spoof requests by providing a crafted request. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://security.archlinux.org/CVE-2017-15710 https://security.archlinux.org/CVE-2017-15715 https://security.archlinux.org/CVE-2018-1283 https://security.archlinux.org/CVE-2018-1301 https://security.archlinux.org/CVE-2018-1302 https://security.archlinux.org/CVE-2018-1303 https://security.archlinux.org/CVE-2018-1312

1 0

[ASA-201804-3] zziplib: denial of service
by Santiago Torres-Arias 09 Apr '18

09 Apr '18

Arch Linux Security Advisory ASA-201804-3 ========================================= Severity: Medium Date : 2018-04-04 CVE-ID : CVE-2018-7725 CVE-2018-7726 CVE-2018-7727 Package : zziplib Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-612 Summary ======= The package zziplib before version 0.13.69-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.13.69-1. # pacman -Syu "zziplib>=0.13.69-1" The problems have been fixed upstream in version 0.13.69. Workaround ========== None. Description =========== - CVE-2018-7725 (denial of service) An out of bounds read was found in function zzip_disk_fread of ZZIPlib before 0.13.69, when ZZIPlib mem_disk functionality is used. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. - CVE-2018-7726 (denial of service) An improper input validation was found in function __zzip_fetch_disk_trailer of ZZIPlib before 0.13.69, that could lead to a crash in __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. - CVE-2018-7727 (denial of service) A memory leak was found in unzip-mem.c and unzzip-mem.c of ZZIPlib before 0.13.69, that could lead to resource exhaustion. Local attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. Impact ====== A remote attacker can cause a denial of service via a specially crafted zip file. References ========== https://github.com/gdraheim/zziplib/issues/39 https://github.com/gdraheim/zziplib/commit/1ba660b3300d67b8ce9f6b96bbae0b36… https://github.com/gdraheim/zziplib/issues/41 https://github.com/gdraheim/zziplib/commit/19c9e4dc6c5cf92a38d0d23dbccac699… https://github.com/gdraheim/zziplib/commit/feae4da1a5c92100c44ebfcbaaa89595… https://github.com/gdraheim/zziplib/issues/40 https://github.com/gdraheim/zziplib/commit/83a2da55922f67e07f22048ac9671a44… https://security.archlinux.org/CVE-2018-7725 https://security.archlinux.org/CVE-2018-7726 https://security.archlinux.org/CVE-2018-7727

1 0

[ASA-201804-2] openssl: multiple issues
by Santiago Torres-Arias 09 Apr '18

09 Apr '18

Arch Linux Security Advisory ASA-201804-2 ========================================= Severity: Medium Date : 2018-04-01 CVE-ID : CVE-2017-3738 CVE-2018-0739 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-540 Summary ======= The package openssl before version 1.1.0.h-1 is vulnerable to multiple issues including denial of service and private key recovery. Resolution ========== Upgrade to 1.1.0.h-1. # pacman -Syu "openssl>=1.1.0.h-1" The problems have been fixed upstream in version 1.1.0.h. Workaround ========== None. Description =========== - CVE-2017-3738 (private key recovery) There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. - CVE-2018-0739 (denial of service) A stack-exhaustion issue has been found in OpenSSL <= 1.1.0h, where constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Impact ====== A remote attacker might be able to recover a private key (in very unlikely cases), or cause a denial of service by providing a crafted ASN.1 type to a vulnerable application. References ========== https://www.openssl.org/news/vulnerabilities.html#2017-3738 https://www.openssl.org/news/secadv/20171207.txt https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f… https://www.openssl.org/news/secadv/20180327.txt https://github.com/openssl/openssl/commit/2ac4c6f7b2b2af20c0e2b0ba05367e454… https://security.archlinux.org/CVE-2017-3738 https://security.archlinux.org/CVE-2018-0739

1 0

[ASA-201804-1] drupal: arbitrary code execution
by Jelle van der Waa 04 Apr '18

04 Apr '18

Arch Linux Security Advisory ASA-201804-1 ========================================= Severity: Critical Date : 2018-04-01 CVE-ID : CVE-2018-7600 Package : drupal Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-665 Summary ======= The package drupal before version 8.5.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.5.1-1. # pacman -Syu "drupal>=8.5.1-1" The problem has been fixed upstream in version 8.5.1. Workaround ========== None. Description =========== A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. Impact ====== A remote attacker is able to execute arbitrary code by performing a specially crafted request. References ========== https://www.drupal.org/sa-core-2018-002 https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-ne… https://github.com/drupal/drupal/commit/5ac8738fa69df34a0635f0907d661b509ff… https://security.archlinux.org/CVE-2018-7600

1 0