December 2020 - Arch-security - lists.archlinux.org

[ASA-202012-16] hostapd: proxy injection
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-16 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-12695 Package : hostapd Type : proxy injection Remote : Yes Link : https://security.archlinux.org/AVG-1322 Summary ======= The package hostapd before version 2.9-4 is vulnerable to proxy injection. Resolution ========== Upgrade to 2.9-4. # pacman -Syu "hostapd>=2.9-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. This issue could allow a device connected to the local network (i.e., a device that has been authorized to transmit packets in the network in which the AP is located) to trigger the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. Impact ====== An attacker on the local network might be able to force the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. References ========== https://bugs.archlinux.org/task/68861 https://w1.fi/security/2020-1/upnp-subscribe-misbehavior-wps-ap.txt http://www.callstranger.com/ https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscription… https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-message-generation-us… https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures… https://security.archlinux.org/CVE-2020-12695

1 0

[ASA-202012-15] minidlna: arbitrary code execution
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-15 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-28926 Package : minidlna Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1321 Summary ======= The package minidlna before version 1.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.3.0-1. # pacman -Syu "minidlna>=1.3.0-1" The problem has been fixed upstream in version 1.3.0. Workaround ========== None. Description =========== ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove. Impact ====== An attacker on the local network can execute arbitrary code via a malicious UPnP HTTP request. References ========== https://www.rootshellsecurity.net/remote-heap-corruption-bug-discovery-mini… https://sourceforge.net/p/minidlna/git/ci/9fba41008adebc1da0f4f6c6e27ae422a… https://security.archlinux.org/CVE-2020-28926

1 0

[ASA-202012-14] chromium: multiple issues
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-14 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1323 Summary ======= The package chromium before version 87.0.4280.88-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, insufficient validation and denial of service. Resolution ========== Upgrade to 87.0.4280.88-1. # pacman -Syu "chromium>=87.0.4280.88-1" The problems have been fixed upstream in version 87.0.4280.88. Workaround ========== None. Description =========== - CVE-2020-16037 (arbitrary code execution) A use after free security issue has been found in the clipboard component of the chromium browser before version 87.0.4280.88. - CVE-2020-16038 (arbitrary code execution) A use after free security issue has been found in the media component of the chromium browser before version 87.0.4280.88. - CVE-2020-16039 (arbitrary code execution) A use after free security issue has been found in the extensions component of the chromium browser before version 87.0.4280.88. - CVE-2020-16040 (insufficient validation) An insufficient data validation security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88. - CVE-2020-16041 (denial of service) An out of bounds read security issue has been found in the networking component of the chromium browser before version 87.0.4280.88. - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. Impact ====== A remote attacker might be able to crash the application, read memory or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-des… https://crbug.com/1142331 https://crbug.com/1138683 https://crbug.com/1149177 https://crbug.com/1150649 https://crbug.com/1151865 https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://security.archlinux.org/CVE-2020-16037 https://security.archlinux.org/CVE-2020-16038 https://security.archlinux.org/CVE-2020-16039 https://security.archlinux.org/CVE-2020-16040 https://security.archlinux.org/CVE-2020-16041 https://security.archlinux.org/CVE-2020-16042

1 0

[ASA-202012-13] pam: authentication bypass
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-13 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-27780 Package : pam Type : authentication bypass Remote : No Link : https://security.archlinux.org/AVG-1297 Summary ======= The package pam before version 1.5.0-2 is vulnerable to authentication bypass. Resolution ========== Upgrade to 1.5.0-2. # pacman -Syu "pam>=1.5.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== The issue can be mitigated by setting a non-empty password for the root user. Description =========== An authentication bypass issue was found in pam 1.5.0. Nonexistent users could authenticate if the root password was empty. Impact ====== In some unusual configurations, a remote user might be able to bypass authentication. References ========== https://github.com/linux-pam/linux-pam/blob/5b7ba35ebfd280c931933fedbf98cb7… https://github.com/linux-pam/linux-pam/pull/300 https://github.com/linux-pam/linux-pam/commit/30fdfb90d9864bcc254a62760aaa1… https://security.archlinux.org/CVE-2020-27780

1 0

[ASA-202012-12] blueman: privilege escalation
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-12 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-15238 Package : blueman Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1259 Summary ======= The package blueman before version 2.1.4-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.1.4-1. # pacman -Syu "blueman>=2.1.4-1" The problem has been fixed upstream in version 2.1.4. Workaround ========== As Polkit-1-support is enabled in Arch, it is possible to limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules. Description =========== In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. That is limited to users in the wheel group in the shipped rules file that do have the privileges anyway. On systems with ISC DHCP client (dhclient), attackers can pass arguments to `ip link` with the interface name that can e.g. be used to bring down an interface or add an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Patches are included in 2.1.4 and master that change the DhcpClient D-Bus method(s) to accept BlueZ network object paths instead of network interface names. A backport to 2.0(.8) is also available. As a workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules. Impact ====== A local attacker might be able to escalate privileges. References ========== https://bugs.archlinux.org/task/68563 https://github.com/blueman-project/blueman/security/advisories/GHSA-jpc9-mg… https://bugs.launchpad.net/ubuntu/+source/blueman/+bug/1897287 https://security.archlinux.org/CVE-2020-15238

1 0

[ASA-202012-11] libproxy-mozjs: denial of service
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-11 ========================================== Severity: Low Date : 2020-12-05 CVE-ID : CVE-2020-25219 Package : libproxy-mozjs Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1226 Summary ======= The package libproxy-mozjs before version 0.4.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.16-1. # pacman -Syu "libproxy-mozjs>=0.4.16-1" The problem has been fixed upstream in version 0.4.16. Workaround ========== None. Description =========== url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP PAC server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion. Impact ====== A remote HTTP PAC server might be able to crash an application via a crafted response. References ========== https://github.com/libproxy/libproxy/issues/134 https://github.com/libproxy/libproxy/pull/136 https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e1… https://security.archlinux.org/CVE-2020-25219

1 0

[ASA-202012-10] libproxy: denial of service
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-10 ========================================== Severity: Low Date : 2020-12-05 CVE-ID : CVE-2020-25219 Package : libproxy Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1226 Summary ======= The package libproxy before version 0.4.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.16-1. # pacman -Syu "libproxy>=0.4.16-1" The problem has been fixed upstream in version 0.4.16. Workaround ========== None. Description =========== url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP PAC server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion. Impact ====== A remote HTTP PAC server might be able to crash an application via a crafted response. References ========== https://github.com/libproxy/libproxy/issues/134 https://github.com/libproxy/libproxy/pull/136 https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e1… https://security.archlinux.org/CVE-2020-25219

1 0

[ASA-202012-9] libproxy-webkit: denial of service
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-9 ========================================= Severity: Low Date : 2020-12-05 CVE-ID : CVE-2020-25219 Package : libproxy-webkit Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1226 Summary ======= The package libproxy-webkit before version 0.4.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.16-1. # pacman -Syu "libproxy-webkit>=0.4.16-1" The problem has been fixed upstream in version 0.4.16. Workaround ========== None. Description =========== url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP PAC server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion. Impact ====== A remote HTTP PAC server might be able to crash an application via a crafted response. References ========== https://github.com/libproxy/libproxy/issues/134 https://github.com/libproxy/libproxy/pull/136 https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e1… https://security.archlinux.org/CVE-2020-25219

1 0

[ASA-202012-8] containerd: privilege escalation
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-8 ========================================= Severity: High Date : 2020-12-05 CVE-ID : CVE-2020-15257 Package : containerd Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1309 Summary ======= The package containerd before version 1.4.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.4.3-1. # pacman -Syu "containerd>=1.4.3-1" The problem has been fixed upstream in version 1.4.3. Workaround ========== If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container. Description =========== In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim's API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. Impact ====== A local attacker might be able to escalate privileges via a malicious container running in the same network namespace as the shim. References ========== https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78… https://github.com/containerd/containerd/commit/428f10fd27eb1f9bd0b9aaa33a6… https://github.com/containerd/containerd/commit/ae3a64aa10d6d9b1567adce0577… https://security.archlinux.org/CVE-2020-15257

1 0

[ASA-202012-7] libslirp: information disclosure
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-7 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-29129 CVE-2020-29130 Package : libslirp Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1305 Summary ======= The package libslirp before version 4.4.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.4.0-1. # pacman -Syu "libslirp>=4.4.0-1" The problems have been fixed upstream in version 4.4.0. Workaround ========== None. Description =========== - CVE-2020-29129 (information disclosure) ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. A privileged guest user may use this flaw to potentially leak host information bytes. - CVE-2020-29130 (information disclosure) slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. A privileged guest user may use this flaw to potentially leak host information bytes. Impact ====== A privileged guest user may be able to access sensitive information from the host memory. References ========== https://www.openwall.com/lists/oss-security/2020/11/27/1 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2e1dcbc0c2af64fcb170… https://git.qemu.org/?p=qemu.git;a=commitdiff;h=37c0c885d19a4c2d69faed891b5… https://security.archlinux.org/CVE-2020-29129 https://security.archlinux.org/CVE-2020-29130

1 0