September 2018 - Arch-security - lists.archlinux.org

[ASA-201809-5] mediawiki: multiple issues
by Jelle van der Waa 28 Sep '18

28 Sep '18

Arch Linux Security Advisory ASA-201809-5 ========================================= Severity: Medium Date : 2018-09-25 CVE-ID : CVE-2018-0503 CVE-2018-0505 CVE-2018-13258 Package : mediawiki Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-765 Summary ======= The package mediawiki before version 1.31.1-1 is vulnerable to multiple issues including access restriction bypass and information disclosure. Resolution ========== Upgrade to 1.31.1-1. # pacman -Syu "mediawiki>=1.31.1-1" The problems have been fixed upstream in version 1.31.1. Workaround ========== None. Description =========== - CVE-2018-0503 (access restriction bypass) A security issue has been found in the rate limiting feature of mediawiki < 1.31.1 where, contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. - CVE-2018-0505 (access restriction bypass) A security issue has been found in mediawiki < 1.31.1 where BotPassword can bypass CentralAuth's account lock. - CVE-2018-13258 (information disclosure) A security issue has been found in mediawiki < 1.31.1 where the tarball is missing .htaccess files used to protect some directories that shouldn't be web accessible. Impact ====== A remote attacker is able to bypass access restrictions put in place by the site administrator and/or gain access to restricted content. References ========== https://www.mediawiki.org/wiki/Release_notes/1.31 https://phabricator.wikimedia.org/T169545 https://github.com/wikimedia/mediawiki/commit/befd48c5f7d3d073de96c87375d73… https://phabricator.wikimedia.org/T194605 https://github.com/wikimedia/mediawiki/commit/ff6b4cb35c1944870fcd3cc525884… https://phabricator.wikimedia.org/T199029 https://github.com/wikimedia/mediawiki/commit/b78d595feecf9de919258b659628c… https://security.archlinux.org/CVE-2018-0503 https://security.archlinux.org/CVE-2018-0505 https://security.archlinux.org/CVE-2018-13258

1 0

[ASA-201809-4] strongswan: authentication bypass
by Jelle van der Waa 25 Sep '18

25 Sep '18

Arch Linux Security Advisory ASA-201809-4 ========================================= Severity: High Date : 2018-09-24 CVE-ID : CVE-2018-16151 CVE-2018-16152 Package : strongswan Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-769 Summary ======= The package strongswan before version 5.7.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 5.7.0-1. # pacman -Syu "strongswan>=5.7.0-1" The problems have been fixed upstream in version 5.7.0. Workaround ========== If the gmp plugin is loaded, make sure that none of the employed keys and certificates (including those of CAs) use keys with e = 3. Strongswan's tool to generate keys (pki --gen) always used e = 65537 (0x10001), which is not vulnerable, so certificates and keys generated with this tool are fine for use even with an unpatched gmp plugin. Description =========== - CVE-2018-16151 (authentication bypass) The OID parser allows any number of random bytes after a valid OID for a PKCS#1.5 signature. The asn1_known_oid() function just parses until it finds a leaf in the tree of known OIDs, any further data that follows is simply ignored. And the function that parses ASN.1 algorithmIdentifier structures doesn't care if the full OID data was parsed as it usually doesn't really matter. A missing check to reject junk and random key parameters allows attackers to carry out a Bleichenbacher-style attack on low-exponent keys and create forged signatures. - CVE-2018-16152 (authentication bypass) The algorithmIdentifier structure on a PKCS#1.5 signature contains an optional parameters field. While none of the algorithms used with PKCS#1 use parameters, i.e. the field should always be encoded as ASN.1 NULL value, the strongswan decoder doesn't enforce this and simply skips over the parameters. This allows an attacker to fill the field with random data which allows to carry out a Bleichenbacher-style attack on low-exponent keys and forge signatures or create arbitrary CA certificates. Impact ====== An attacker is able to use non-validated fields on a maliciously- crafted file to forge a signature or a CA certificate. References ========== https://wiki.strongswan.org/versions/70 https://github.com/strongswan/strongswan/commit/5955db5b124a1ee5f44c0845b6e… https://security.archlinux.org/CVE-2018-16151 https://security.archlinux.org/CVE-2018-16152

1 0

[ASA-201809-3] zsh: insufficient validation
by Jelle van der Waa 25 Sep '18

25 Sep '18

Arch Linux Security Advisory ASA-201809-3 ========================================= Severity: Low Date : 2018-09-24 CVE-ID : CVE-2018-0502 CVE-2018-13259 Package : zsh Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-764 Summary ======= The package zsh before version 5.6-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 5.6-1. # pacman -Syu "zsh>=5.6-1" The problems have been fixed upstream in version 5.6. Workaround ========== None. Description =========== - CVE-2018-0502 (insufficient validation) An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line. - CVE-2018-13259 (insufficient validation) An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one. Impact ====== A local attacker is able to execute arbitrary commands via a specially crafted shell script. References ========== https://www.zsh.org/mla/zsh-announce/136 https://bugs.debian.org/908000 https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a4022… https://security.archlinux.org/CVE-2018-0502 https://security.archlinux.org/CVE-2018-13259

1 0

[ASA-201809-2] bitcoin-qt: denial of service
by Christian Rebischke 22 Sep '18

22 Sep '18

Arch Linux Security Advisory ASA-201809-2 ========================================= Severity: Medium Date : 2018-09-22 CVE-ID : CVE-2018-17144 Package : bitcoin-qt Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-766 Summary ======= The package bitcoin-qt before version 0.16.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.16.3-1. # pacman -Syu "bitcoin-qt>=0.16.3-1" The problem has been fixed upstream in version 0.16.3. Workaround ========== None. Description =========== Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. Any attempts to double-spend a transaction output within a single transaction inside of a block where the output being spent was created in the same block, the same assertion failure will occur (as exists in the test case which was included in the 0.16.3 patch). However, if the output being double-spent was created in a previous block, an entry will still remain in the CCoin map with the DIRTY flag set and having been marked as spent, resulting in no such assertion. This could allow a miner to inflate the supply of Bitcoin as they would then be able to claim the value being spent twice. Impact ====== A remote attacker is able to crash the bitcoin-daemon or the bitcoin-qt application. This vulnerability could allow a miner to inflate the supply of Bitcoin as they would then be able to claim value being spent twice. References ========== https://bitcoincore.org/en/2018/09/20/notice/ https://security.archlinux.org/CVE-2018-17144

1 0

[ASA-201809-1] bitcoin-daemon: denial of service
by Christian Rebischke 22 Sep '18

22 Sep '18

Arch Linux Security Advisory ASA-201809-1 ========================================= Severity: Medium Date : 2018-09-22 CVE-ID : CVE-2018-17144 Package : bitcoin-daemon Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-766 Summary ======= The package bitcoin-daemon before version 0.16.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.16.3-1. # pacman -Syu "bitcoin-daemon>=0.16.3-1" The problem has been fixed upstream in version 0.16.3. Workaround ========== None. Description =========== Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. Any attempts to double-spend a transaction output within a single transaction inside of a block where the output being spent was created in the same block, the same assertion failure will occur (as exists in the test case which was included in the 0.16.3 patch). However, if the output being double-spent was created in a previous block, an entry will still remain in the CCoin map with the DIRTY flag set and having been marked as spent, resulting in no such assertion. This could allow a miner to inflate the supply of Bitcoin as they would then be able to claim the value being spent twice. Impact ====== A remote attacker is able to crash the bitcoin-daemon or the bitcoin-qt application. This vulnerability could allow a miner to inflate the supply of Bitcoin as they would then be able to claim value being spent twice. References ========== https://bitcoincore.org/en/2018/09/20/notice/ https://security.archlinux.org/CVE-2018-17144

1 0