June 2020 - Arch-security - lists.archlinux.org

[ASA-202006-6] tomcat7: arbitrary code execution
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-6 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-9484 Package : tomcat7 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1169 Summary ======= The package tomcat7 before version 7.0.104-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.0.104-1. # pacman -Syu "tomcat7>=7.0.104-1" The problem has been fixed upstream in version 7.0.104. Workaround ========== None. Description =========== When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if: a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. Impact ====== A remote attacker can execute code on the affected host if they control the file content and know the path. References ========== https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa2… https://security.archlinux.org/CVE-2020-9484

1 0

[ASA-202006-5] tomcat8: arbitrary code execution
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-5 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-9484 Package : tomcat8 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1170 Summary ======= The package tomcat8 before version 8.5.55-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.5.55-1. # pacman -Syu "tomcat8>=8.5.55-1" The problem has been fixed upstream in version 8.5.55. Workaround ========== None. Description =========== When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if: a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. Impact ====== A remote attacker can execute code on the affected host if they control the file content and know the path. References ========== https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa2… https://security.archlinux.org/CVE-2020-9484

1 0

[ASA-202006-4] thunderbird: multiple issues
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-4 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-12398 CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12410 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1179 Summary ======= The package thunderbird before version 68.9.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, man-in-the-middle and private key recovery. Resolution ========== Upgrade to 68.9.0-1. # pacman -Syu "thunderbird>=68.9.0-1" The problems have been fixed upstream in version 68.9.0. Workaround ========== None. Description =========== - CVE-2020-12398 (man-in-the-middle) A security downgrade issue has been found in Thunderbird before 68.9.0. If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. - CVE-2020-12399 (private key recovery) NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird before 68.9.0, has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. - CVE-2020-12405 (denial of service) When browsing a malicious page in Firefox before 77.0 and Thunderbird before 68.9.0, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. - CVE-2020-12406 (arbitrary code execution) Mozilla Developer Iain Ireland discovered a missing type check in Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. - CVE-2020-12410 (arbitrary code execution) Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before 68.9.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to recover private keys, downgrade an encrypted connection, execute arbitrary code or crash the application. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1613623 https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/ https://bugzilla.mozilla.org/show_bug.cgi?id=1631576 https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429… https://bugzilla.mozilla.org/show_bug.cgi?id=1631618 https://bugzilla.mozilla.org/show_bug.cgi?id=1639590 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 https://security.archlinux.org/CVE-2020-12398 https://security.archlinux.org/CVE-2020-12399 https://security.archlinux.org/CVE-2020-12405 https://security.archlinux.org/CVE-2020-12406 https://security.archlinux.org/CVE-2020-12410

1 0

[ASA-202006-3] chromium: multiple issues
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-3 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-6493 CVE-2020-6494 CVE-2020-6495 CVE-2020-6496 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1178 Summary ======= The package chromium before version 83.0.4103.97-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution and content spoofing. Resolution ========== Upgrade to 83.0.4103.97-1. # pacman -Syu "chromium>=83.0.4103.97-1" The problems have been fixed upstream in version 83.0.4103.97. Workaround ========== None. Description =========== - CVE-2020-6493 (arbitrary code execution) A use-after-free security issue has been found in the WebAuthentication component of the chromium browser before 83.0.4103.97. - CVE-2020-6494 (content spoofing) An incorrect security UI security issue has been found in the payments component of the chromium browser before 83.0.4103.97 - CVE-2020-6495 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.97. - CVE-2020-6496 (arbitrary code execution) A use-after-free security issue has been found in the payments component of the chromium browser before 83.0.4103.97. Impact ====== A remote attacker might be able to spoof content, bypass security restrictions or validations checks, or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-des… https://crbug.com/1082105 https://crbug.com/1083972 https://crbug.com/1072116 https://crbug.com/1085990 https://security.archlinux.org/CVE-2020-6493 https://security.archlinux.org/CVE-2020-6494 https://security.archlinux.org/CVE-2020-6495 https://security.archlinux.org/CVE-2020-6496

1 0

[ASA-202006-2] gnutls: man-in-the-middle
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-2 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-13777 Package : gnutls Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-1177 Summary ======= The package gnutls before version 3.6.14-1 is vulnerable to man-in-the- middle. Resolution ========== Upgrade to 3.6.14-1. # pacman -Syu "gnutls>=3.6.14-1" The problem has been fixed upstream in version 3.6.14. Workaround ========== None. Description =========== GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. Impact ====== A remote attacker can man-in-the-middle a connection to bypass authentication in TLS 1.3, and recover previous conversations in TLS 1.2. References ========== https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03 https://gitlab.com/gnutls/gnutls/-/issues/1011 https://gitlab.com/gnutls/gnutls/-/commit/c2646aeee94e71cb15c90a3147cf3b5b0… https://security.archlinux.org/CVE-2020-13777

1 0

[ASA-202006-1] firefox: multiple issues
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-1 ========================================= Severity: High Date : 2020-06-02 CVE-ID : CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12407 CVE-2020-12408 CVE-2020-12409 CVE-2020-12410 CVE-2020-12411 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1173 Summary ======= The package firefox before version 77.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, private key recovery and content spoofing. Resolution ========== Upgrade to 77.0-1. # pacman -Syu "firefox>=77.0-1" The problems have been fixed upstream in version 77.0. Workaround ========== None. Description =========== - CVE-2020-12399 (private key recovery) NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird before 68.9.0, has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. - CVE-2020-12405 (denial of service) When browsing a malicious page in Firefox before 77.0 and Thunderbird before 68.9.0, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. - CVE-2020-12406 (arbitrary code execution) Mozilla Developer Iain Ireland discovered a missing type check in Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. - CVE-2020-12407 (denial of service) Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but not observable from web content. - CVE-2020-12408 (content spoofing) When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. - CVE-2020-12409 (content spoofing) When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. - CVE-2020-12410 (arbitrary code execution) Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before 68.9.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-12411 (arbitrary code execution) Mozilla developers :Gijs (he/him), Randell Jesup reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to recover private keys, spoof content, execute arbitrary code or crash the application. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/ https://bugzilla.mozilla.org/show_bug.cgi?id=1631576 https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429… https://bugzilla.mozilla.org/show_bug.cgi?id=1631618 https://bugzilla.mozilla.org/show_bug.cgi?id=1639590 https://bugzilla.mozilla.org/show_bug.cgi?id=1637112 https://bugzilla.mozilla.org/show_bug.cgi?id=1623888 https://bugzilla.mozilla.org/show_bug.cgi?id=1629506 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 https://bugzilla.mozilla.org/show_bug.cgi?id=1506173 https://security.archlinux.org/CVE-2020-12399 https://security.archlinux.org/CVE-2020-12405 https://security.archlinux.org/CVE-2020-12406 https://security.archlinux.org/CVE-2020-12407 https://security.archlinux.org/CVE-2020-12408 https://security.archlinux.org/CVE-2020-12409 https://security.archlinux.org/CVE-2020-12410 https://security.archlinux.org/CVE-2020-12411

1 0

[ASA-202005-16] freerdp: information disclosure
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-16 ========================================== Severity: High Date : 2020-05-23 CVE-ID : CVE-2020-13396 CVE-2020-13397 CVE-2020-13398 Package : freerdp Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1172 Summary ======= The package freerdp before version 2:2.1.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2:2.1.1-1. # pacman -Syu "freerdp>=2:2.1.1-1" The problems have been fixed upstream in version 2.1.1. Workaround ========== None. Description =========== - CVE-2020-13396 (information disclosure) An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. - CVE-2020-13397 (information disclosure) An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value. - CVE-2020-13398 (information disclosure) An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. Impact ====== A local malicious user can send crafted network traffic and leak information from the host. References ========== https://github.com/FreeRDP/FreeRDP/commit/48361c411e50826cb602c7aab773a8a20… https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae9110462… https://github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a3488… https://github.com/FreeRDP/FreeRDP/commit/8305349a943c68b1bc8c158f431dc6076… https://security.archlinux.org/CVE-2020-13396 https://security.archlinux.org/CVE-2020-13397 https://security.archlinux.org/CVE-2020-13398

1 0

[ASA-202005-15] ant: arbitrary command execution
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-15 ========================================== Severity: Medium Date : 2020-05-20 CVE-ID : CVE-2020-1945 Package : ant Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-1159 Summary ======= The package ant before version 1.10.8-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.10.8-1. # pacman -Syu "ant>=1.10.8-1" The problem has been fixed upstream in version 1.10.8. Workaround ========== None. Description =========== Apache Ant uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. Impact ====== A local malicious user can inject code into the ant build process. References ========== https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78… https://security.archlinux.org/CVE-2020-1945

1 0

[ASA-202005-14] unbound: denial of service
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-14 ========================================== Severity: High Date : 2020-05-20 CVE-ID : CVE-2020-12662 CVE-2020-12663 Package : unbound Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1164 Summary ======= The package unbound before version 1.10.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.1-1. # pacman -Syu "unbound>=1.10.1-1" The problems have been fixed upstream in version 1.10.1. Workaround ========== None. Description =========== - CVE-2020-12662 (denial of service) An issue has been found in unbound before 1.10.1, that makes it possible to have a single incoming query result in a large number of outgoing queries. This amplification makes it possible for Unbound to be used in a denial of service attack. The researchers discovering this called this attack the NXNSattack.This attack makes use of cache bypassing using random subdomains in the NSDNAME in NS records. When these delegation records are received during iteration, and the answer does not contain glue records, a resolver has to send out a query to the get the IP address for one of the names. When this query fails (for example because the random name does not exist) a resolver will try the next one. A large set of NS records with random names can result in a large number of outgoing queries going to the same target. - CVE-2020-12663 (denial of service) A security issue has been found in Unbound before 1.1.0.1, in the parser of received answers. Malformed answers received from upstream servers can result in Unbound entering an infinite loop and thereby becoming unresponsive. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker can crash the application via a crafted request. References ========== https://nlnetlabs.nl/projects/unbound/security-advisories/ https://nlnetlabs.nl/downloads/unbound/patch_cve_2020-12662_2020-12663.diff http://www.nxnsattack.com/ https://security.archlinux.org/CVE-2020-12662 https://security.archlinux.org/CVE-2020-12663

1 0

[ASA-202005-13] bind: denial of service
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-13 ========================================== Severity: High Date : 2020-05-20 CVE-ID : CVE-2020-8616 CVE-2020-8617 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1165 Summary ======= The package bind before version 9.16.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.16.3-1. # pacman -Syu "bind>=9.16.3-1" The problems have been fixed upstream in version 9.16.3. Workaround ========== None. Description =========== - CVE-2020-8616 (denial of service) An issue has been found in bind before 9.16.3, which does not sufficiently limit the number of fetches which may be performed while processing a referral response. A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: the performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and the attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. - CVE-2020-8617 (denial of service) An error in bind before 9.16.3 in the code which checks the validity of messages containing TSIG resource records can be exploited by an attacker to trigger an assertion failure in tsig.c, resulting in denial of service to clients. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker can crash the application by guessing the TSIG key name. References ========== https://kb.isc.org/docs/cve-2020-8616 https://kb.isc.org/docs/cve-2020-8617 https://kb.isc.org/docs/cve-2020-8617-faq-and-supplemental-information http://www.nxnsattack.com/ https://security.archlinux.org/CVE-2020-8616 https://security.archlinux.org/CVE-2020-8617

1 0