December 2019 - Arch-security - lists.archlinux.org

[ASA-201912-6] git: arbitrary code execution
by Morten Linderud 18 Dec '19

18 Dec '19

Arch Linux Security Advisory ASA-201912-6 ========================================= Severity: High Date : 2019-12-18 CVE-ID : CVE-2019-1348 CVE-2019-1349 CVE-2019-1352 CVE-2019-1387 CVE-2019-19604 Package : git Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1073 Summary ======= The package git before version 2.24.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.24.1-1. # pacman -Syu "git>=2.24.1-1" The problems have been fixed upstream in version 2.24.1. Workaround ========== None. Description =========== - CVE-2019-1348 (arbitrary code execution) A security issue has been found in git before 2.24.1 where the --export-marks option of git fast-import is exposed also via the in- stream command feature export-marks=... and it allows overwriting arbitrary paths. - CVE-2019-1349 (arbitrary code execution) A security issue has been found in git before 2.24.1 when using submodule paths that refer to the same file system entity (e.g. using the NTFS Alternate Data Streams attack mentioned in CVE-2019-1352 where files would be written to the `.git/` directory using a synonymous directory name), it was possible to "squat" on the `git~1` shortname on NTFS drives, opening attacks via `git~2`. This also affects Git when run as a Linux application inside the Windows Subsystem for Linux. - CVE-2019-1352 (arbitrary code execution) A security issue has been found in git before 2.24.1 where it was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone. - CVE-2019-1387 (arbitrary code execution) A security issue has been found in git before 2.24.1 where recursive clones are currently affected by a vulnerability that is caused by too- lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones. - CVE-2019-19604 (arbitrary code execution) A security issue has been found in git before 2.24.1, and it is now disallowed for `.gitmodules` to have entries that set `submodule.<name>.update=!command`. This fixes the vulnerability in Git v2.20.0 and later where a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that. Impact ====== A remote attacker can overwrite files and execute code by abusing NTFS path, submodules and fast-import. References ========== https://github.com/git/git/commit/68061e3470210703cb15594194718d35094afdc0 https://lkml.org/lkml/2019/12/10/905 https://github.com/git/git/commit/0060fd1511b94c918928fa3708f69a3f33895a4a https://github.com/git/git/commit/7c3745fc6185495d5765628b4dfe1bd2c25a2981 https://github.com/git/git/commit/a8dee3ca610f5a1d403634492136c887f83b59d2 https://github.com/git/git/commit/c1547450748fcbac21675f2681506d2d80351a19 https://security.archlinux.org/CVE-2019-1348 https://security.archlinux.org/CVE-2019-1349 https://security.archlinux.org/CVE-2019-1352 https://security.archlinux.org/CVE-2019-1387 https://security.archlinux.org/CVE-2019-19604

1 0

[ASA-201912-5] libgit2: arbitrary code execution
by Morten Linderud 18 Dec '19

18 Dec '19

Arch Linux Security Advisory ASA-201912-5 ========================================= Severity: High Date : 2019-12-18 CVE-ID : CVE-2019-1348 CVE-2019-1349 CVE-2019-1352 CVE-2019-1387 Package : libgit2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1075 Summary ======= The package libgit2 before version 1:0.28.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:0.28.4-1. # pacman -Syu "libgit2>=1:0.28.4-1" The problems have been fixed upstream in version 0.28.4. Workaround ========== None. Description =========== - CVE-2019-1348 (arbitrary code execution) A security issue has been found in git before 2.24.1 where the --export-marks option of git fast-import is exposed also via the in- stream command feature export-marks=... and it allows overwriting arbitrary paths. - CVE-2019-1349 (arbitrary code execution) A security issue has been found in git before 2.24.1 when using submodule paths that refer to the same file system entity (e.g. using the NTFS Alternate Data Streams attack mentioned in CVE-2019-1352 where files would be written to the `.git/` directory using a synonymous directory name), it was possible to "squat" on the `git~1` shortname on NTFS drives, opening attacks via `git~2`. This also affects Git when run as a Linux application inside the Windows Subsystem for Linux. - CVE-2019-1352 (arbitrary code execution) A security issue has been found in git before 2.24.1 where it was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone. - CVE-2019-1387 (arbitrary code execution) A security issue has been found in git before 2.24.1 where recursive clones are currently affected by a vulnerability that is caused by too- lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones. Impact ====== A remote attacker can overwrite files and execute code by abusing NTFS path, submodules and fast-import. References ========== https://github.com/git/git/commit/68061e3470210703cb15594194718d35094afdc0 https://lkml.org/lkml/2019/12/10/905 https://github.com/git/git/commit/0060fd1511b94c918928fa3708f69a3f33895a4a https://github.com/git/git/commit/7c3745fc6185495d5765628b4dfe1bd2c25a2981 https://github.com/git/git/commit/a8dee3ca610f5a1d403634492136c887f83b59d2 https://security.archlinux.org/CVE-2019-1348 https://security.archlinux.org/CVE-2019-1349 https://security.archlinux.org/CVE-2019-1352 https://security.archlinux.org/CVE-2019-1387

1 0

[ASA-201912-4] shadow: privilege escalation
by Levente Polyak 18 Dec '19

18 Dec '19

Arch Linux Security Advisory ASA-201912-4 ========================================= Severity: High Date : 2019-12-18 CVE-ID : CVE-2019-19882 Package : shadow Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1079 Summary ======= The package shadow before version 4.8-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.8-1. # pacman -Syu "shadow>=4.8-1" The problem has been fixed upstream in version 4.8. Workaround ========== None. Description =========== shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8). Impact ====== A local authenticated user can escalate privileges by using setuid binaries. References ========== https://bugs.archlinux.org/task/64836 https://bugs.gentoo.org/702252 https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac589… https://github.com/shadow-maint/shadow/pull/199 https://github.com/void-linux/void-packages/pull/17580 https://security.archlinux.org/CVE-2019-19882

1 0

[ASA-201912-3] crypto++: private key recovery
by Remi Gacogne 11 Dec '19

11 Dec '19

Arch Linux Security Advisory ASA-201912-3 ========================================= Severity: High Date : 2019-12-06 CVE-ID : CVE-2019-14318 Package : crypto++ Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-1046 Summary ======= The package crypto++ before version 8.2.0-2 is vulnerable to private key recovery. Resolution ========== Upgrade to 8.2.0-2. # pacman -Syu "crypto++>=8.2.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A vulnerability has been found in the ECDSA/EdDSA implementation of crypto++ up to 8.2.0, allowing for practical recovery of the long-term private key. Impact ====== An attacker might be able to recover long-term private key by measuring the duration of hundreds to thousands of signing operations of known messages. References ========== https://seclists.org/oss-sec/2019/q4/3 https://minerva.crocs.fi.muni.cz/ https://github.com/weidai11/cryptopp/issues/869 https://github.com/weidai11/cryptopp/pull/870/commits/80c59bcdb251043f27eef… https://github.com/weidai11/cryptopp/commit/c9ef9420e762 https://security.archlinux.org/CVE-2019-14318

1 0

[ASA-201912-2] thunderbird: arbitrary code execution
by Remi Gacogne 11 Dec '19

11 Dec '19

Arch Linux Security Advisory ASA-201912-2 ========================================= Severity: Critical Date : 2019-12-06 CVE-ID : CVE-2019-11745 CVE-2019-17005 CVE-2019-17008 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1072 Summary ======= The package thunderbird before version 68.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 68.3.0-1. # pacman -Syu "thunderbird>=68.3.0-1" The problems have been fixed upstream in version 68.3.0. Workaround ========== None. Description =========== - CVE-2019-11745 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the NSS component of Firefox before 71.0 and Thunderbird before 68.3. When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. - CVE-2019-17005 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3 where the plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. - CVE-2019-17008 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. When using nested workers, a use-after- free could occur during worker destruction. This resulted in a potentially exploitable crash. - CVE-2019-17010 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. - CVE-2019-17011 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. - CVE-2019-17012 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0 and Thunderbird before 68.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667… https://security.archlinux.org/CVE-2019-11745 https://security.archlinux.org/CVE-2019-17005 https://security.archlinux.org/CVE-2019-17008 https://security.archlinux.org/CVE-2019-17010 https://security.archlinux.org/CVE-2019-17011 https://security.archlinux.org/CVE-2019-17012

1 0

[ASA-201912-1] firefox: multiple issues
by Remi Gacogne 05 Dec '19

05 Dec '19

Arch Linux Security Advisory ASA-201912-1 ========================================= Severity: Critical Date : 2019-12-03 CVE-ID : CVE-2019-11745 CVE-2019-11756 CVE-2019-17005 CVE-2019-17008 CVE-2019-17009 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012 CVE-2019-17013 CVE-2019-17014 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1071 Summary ======= The package firefox before version 71.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, information disclosure and privilege escalation. Resolution ========== Upgrade to 71.0-1. # pacman -Syu "firefox>=71.0-1" The problems have been fixed upstream in version 71.0. Workaround ========== None. Description =========== - CVE-2019-11745 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the NSS component of Firefox before 71.0. When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. - CVE-2019-11756 (denial of service) A use-after-free vulnerability has been found in Firefox before 71.0 where improper reference counting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). - CVE-2019-17005 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox before 71.0 where the plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. - CVE-2019-17008 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. - CVE-2019-17009 (privilege escalation) A privilege escalation vulnerability has been found in Firefox before 71.0. When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. - CVE-2019-17010 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. - CVE-2019-17011 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. - CVE-2019-17012 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17013 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17014 (information disclosure) An information disclosure issue has been found in Firefox before 71.0 where, if an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. Impact ====== A remote attacker can crash Firefox, access sensitive information, escalate privileges and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1508776 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1510494 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667… https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439… https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1322864 https://security.archlinux.org/CVE-2019-11745 https://security.archlinux.org/CVE-2019-11756 https://security.archlinux.org/CVE-2019-17005 https://security.archlinux.org/CVE-2019-17008 https://security.archlinux.org/CVE-2019-17009 https://security.archlinux.org/CVE-2019-17010 https://security.archlinux.org/CVE-2019-17011 https://security.archlinux.org/CVE-2019-17012 https://security.archlinux.org/CVE-2019-17013 https://security.archlinux.org/CVE-2019-17014

1 0

[ASA-201911-14] intel-ucode: multiple issues
by Remi Gacogne 03 Dec '19

03 Dec '19

Arch Linux Security Advisory ASA-201911-14 ========================================== Severity: High Date : 2019-11-13 CVE-ID : CVE-2019-0117 CVE-2019-11135 CVE-2019-11139 Package : intel-ucode Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1068 Summary ======= The package intel-ucode before version 20191112-1 is vulnerable to multiple issues including information disclosure, private key recovery and denial of service. Resolution ========== Upgrade to 20191112-1. # pacman -Syu "intel-ucode>=20191112-1" The problems have been fixed upstream in version 20191112. Workaround ========== None. Description =========== - CVE-2019-0117 (information disclosure) A flaw was found in the implementation of SGX around the access control of protected memory. A local attacker of a system with SGX enabled and an affected intel GPU with the ability to execute code is able to infer the contents of the SGX protected memory. - CVE-2019-11135 (private key recovery) A flaw was found in the way Intel CPUs handle speculative execution of instructions when the TSX Asynchronous Abort (TAA) error occurs. A local authenticated attacker with the ability to monitor execution times could infer the TSX memory state by comparing abort execution times. This could allow information disclosure via this observed side- channel for any TSX transaction being executed while an attacker is able to observe abort timing. Intel's Transactional Synchronisation Extensions (TSX) are set of instructions which enable transactional memory support to improve performance of the multi-threaded applications, in the lock-protected critical sections. The CPU executes instructions in the critical-sections as transactions, while ensuring their atomic state. When such transaction execution is unsuccessful, the processor cannot ensure atomic updates to the transaction memory, so the processor rolls back or aborts such transaction execution. While TSX Asynchronous Abort (TAA) is pending, CPU may continue to read data from architectural buffers and pass it to the dependent speculative operations. This may cause information leakage via speculative side- channel means, which is quite similar to the Microarchitectural Data Sampling (MDS) issue. This mitigation is only effective using one the follow linux kernels: v3.16.77, v4.4.202, v4.9.202, v4.14.154, v4.19.84 or v5.3.11. - CVE-2019-11139 (denial of service) It was discovered that certain Intel Xeon processors did not properly restrict access to a voltage modulation interface. A local privileged attacker could use this to cause a denial of service (system crash). Impact ====== A local unprivileged attacker with access to an affected GPU can read protected memory on an SGX enclave. Further, an attacker can infer the contents of TPM keys using side-channel attacks. Finally, an attacker can crash the system by accessing the voltage modulator interface on certain Xeon processors. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://software.intel.com/security-software-guidance/insights/deep-dive-in… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://security.archlinux.org/CVE-2019-0117 https://security.archlinux.org/CVE-2019-11135 https://security.archlinux.org/CVE-2019-11139

1 0

[ASA-201911-13] libtiff: denial of service
by Remi Gacogne 03 Dec '19

03 Dec '19

Arch Linux Security Advisory ASA-201911-13 ========================================== Severity: Medium Date : 2019-11-13 CVE-ID : CVE-2019-6128 CVE-2019-7663 Package : libtiff Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-886 Summary ======= The package libtiff before version 4.1.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.1.0-1. # pacman -Syu "libtiff>=4.1.0-1" The problems have been fixed upstream in version 4.1.0. Workaround ========== None. Description =========== - CVE-2019-6128 (denial of service) The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb. - CVE-2019-7663 (denial of service) An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. Impact ====== A remote attacker is able to cause a denial of service. References ========== https://gitlab.com/libtiff/libtiff/commit/ae0bed1fe530a82faf2e9ea1775109dbf… https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17… https://gitlab.com/libtiff/libtiff/merge_requests/60 https://security.archlinux.org/CVE-2019-6128 https://security.archlinux.org/CVE-2019-7663

1 0