- Arch-security - lists.archlinux.org

[arch-security] [ASA-201706-30] linux-zen: privilege escalation
by Levente Polyak 23 Jun '17

23 Jun '17

Arch Linux Security Advisory ASA-201706-30 ========================================== Severity: High Date : 2017-06-23 CVE-ID : CVE-2017-1000364 Package : linux-zen Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-324 Summary ======= The package linux-zen before version 4.11.6-3 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.11.6-3. # pacman -Syu "linux-zen>=4.11.6-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult. Impact ====== A local attacker is able to bypass the stack guard for user space binaries effectively leading to elevation of privileges by choosing a suitable target application. References ========== https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://git.kernel.org/linus/1be7107fbe18eed3e319a6c3e83c78254b693acb https://security.archlinux.org/CVE-2017-1000364

1 0

[arch-security] [ASA-201706-29] tcpreplay: arbitrary code execution
by Santiago Torres-Arias 23 Jun '17

23 Jun '17

Arch Linux Security Advisory ASA-201706-29 ========================================== Severity: High Date : 2017-06-23 CVE-ID : CVE-2017-6429 Package : tcpreplay Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-211 Summary ======= The package tcpreplay before version 4.2.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.2.5-1. # pacman -Syu "tcpreplay>=4.2.5-1" The problem has been fixed upstream in version 4.2.5. Workaround ========== None. Description =========== Buffer overflow in the tcpcapinfo utility in tcpreplay before 4.2.0 Beta 1 allows attackers to have unspecified impact via a pcap file with an over-size packet. Impact ====== An attacker can provide a crafted pcap file with an over-size packet to execute arbitrary code with the privileges of the tcpcapinfo process. References ========== https://github.com/appneta/tcpreplay/commit/d689d14dbcd768c028eab2fb378d849… https://github.com/appneta/tcpreplay/issues/278 http://www.securityfocus.com/bid/96579 https://security.archlinux.org/CVE-2017-6429

1 0

[arch-security] [ASA-201706-28] linux-hardened: privilege escalation
by Levente Polyak 22 Jun '17

22 Jun '17

Arch Linux Security Advisory ASA-201706-28 ========================================== Severity: High Date : 2017-06-22 CVE-ID : CVE-2017-1000364 Package : linux-hardened Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-314 Summary ======= The package linux-hardened before version 4.11.6.d-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.11.6.d-1. # pacman -Syu "linux-hardened>=4.11.6.d-1" The problem has been fixed upstream in version 4.11.6.d. Workaround ========== None. Description =========== A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult. Impact ====== A local attacker is able to bypass the stack guard for user space binaries effectively leading to elevation of privileges by choosing a suitable target application. References ========== https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://github.com/copperhead/linux-hardened/commit/f8551076b4fade2df491a3b… https://git.kernel.org/linus/1be7107fbe18eed3e319a6c3e83c78254b693acb https://security.archlinux.org/CVE-2017-1000364

1 0

[arch-security] [ASA-201706-27] openvpn: multiple issues
by Remi Gacogne 22 Jun '17

22 Jun '17

Arch Linux Security Advisory ASA-201706-27 ========================================== Severity: Critical Date : 2017-06-22 CVE-ID : CVE-2017-7508 CVE-2017-7512 CVE-2017-7520 CVE-2017-7521 Package : openvpn Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-318 Summary ======= The package openvpn before version 2.4.3-1 is vulnerable to multiple issues including information disclosure, arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.4.3-1. # pacman -Syu "openvpn>=2.4.3-1" The problems have been fixed upstream in version 2.4.3. Workaround ========== None. Description =========== - CVE-2017-7508 (denial of service) A remote denial of service has been found in OpenVPN < 2.4.3, allowing a remote client to crash a server by sending a malformed IPv6 packet. The issue requires IPv6 and the --mssfix option to be enabled, and knowledge of the IPv6 networks used inside the VPN. - CVE-2017-7512 (denial of service) A remote denial of service has been found in OpenVPN < 2.4.3. A remote client can exploit a memory leak in the server's certificate parsing code to make it leak a few bytes of memory for each connection attempt, causing it to run out of memory. - CVE-2017-7520 (information disclosure) A pre-authentication remote crash/information disclosure vulnerability has been discovered in OpenVPN < 2.4.3. If the client uses a HTTP proxy with NTLM authentication (i.e. "--http-proxy <server> <port> [<authfile>|'auto'|'auto-nct'] ntlm2") to connect to the OpenVPN server, an attacker in position of man-in-the-middle between the client and the proxy can cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory is likely to contain the proxy password. - CVE-2017-7521 (arbitrary code execution) A use-after-free has been found in OpenVPN < 2.4.3. The issue is caused by extract_x509_extension() not checking the return value of ASN1_STRING_to_UTF8(), and using then freeing a memory allocation that has already been freed if it failed. The issue requires the use of the --x509-alt-username option with an x509 extension, and is very unlikely to be triggered unless the remote peer can make the local process run out of memory. Impact ====== An attacker in position of man-in-the-middle can access sensitive information from a client using a HTTP proxy with NTLM authentication to connect to the server. A remote attacker can crash a server and possibly execute arbitrary code on the affected host under specific conditions. References ========== https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 https://guidovranken.wordpress.com/2017/06/21/the-openvpn-post-audit-bug-bo… https://github.com/OpenVPN/openvpn/commit/c3f47077a7 https://github.com/OpenVPN/openvpn/commit/2341f71619 https://github.com/OpenVPN/openvpn/commit/7718c8984f https://github.com/OpenVPN/openvpn/commit/cb4e35ece4 https://github.com/OpenVPN/openvpn/commit/2d032c7fcd https://security.archlinux.org/CVE-2017-7508 https://security.archlinux.org/CVE-2017-7512 https://security.archlinux.org/CVE-2017-7520 https://security.archlinux.org/CVE-2017-7521

1 0

[arch-security] [ASA-201706-26] pcmanfm: denial of service
by Remi Gacogne 22 Jun '17

22 Jun '17

Arch Linux Security Advisory ASA-201706-26 ========================================== Severity: Medium Date : 2017-06-22 CVE-ID : CVE-2017-8934 Package : pcmanfm Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-274 Summary ======= The package pcmanfm before version 1.2.5-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1.2.5-2. # pacman -Syu "pcmanfm>=1.2.5-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The socket placed in /tmp by pcmanfm is predictable and public- writable. Therefore if one user placed a symlink to another socket instead of socket for another user then said another user will either be unable to use pcmanfm, or may send requests to the first user's pcmanfm. Impact ====== A local attacker might be able to cause a denial of service or trick the user into sending requests to another pcmanfm instance. References ========== https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862571 https://git.lxde.org/gitweb/?p=lxde/pcmanfm.git;a=commitdiff;h=bc8c3d871e9e… https://security.archlinux.org/CVE-2017-8934

1 0

[arch-security] [ASA-201706-25] lxterminal: access restriction bypass
by Remi Gacogne 22 Jun '17

22 Jun '17

Arch Linux Security Advisory ASA-201706-25 ========================================== Severity: Medium Date : 2017-06-22 CVE-ID : CVE-2016-10369 Package : lxterminal Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-264 Summary ======= The package lxterminal before version 0.3.0-2 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 0.3.0-2. # pacman -Syu "lxterminal>=0.3.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control). Impact ====== A local attacker might be able to cause a denial of service or bypass the terminal access control to gain privileges or access sensitive information. References ========== https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commitdiff;h=f99163c6f… https://unix.stackexchange.com/questions/333539/lxterminal-in-the-netstat-o… https://bugs.debian.org/862098 https://security.archlinux.org/CVE-2016-10369

1 0

[arch-security] [ASA-201706-24] lxterminal-gtk3: access restriction bypass
by Remi Gacogne 22 Jun '17

22 Jun '17

Arch Linux Security Advisory ASA-201706-24 ========================================== Severity: Medium Date : 2017-06-22 CVE-ID : CVE-2016-10369 Package : lxterminal-gtk3 Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-264 Summary ======= The package lxterminal-gtk3 before version 0.3.0-2 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 0.3.0-2. # pacman -Syu "lxterminal-gtk3>=0.3.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control). Impact ====== A local attacker might be able to cause a denial of service or bypass the terminal access control to gain privileges or access sensitive information. References ========== https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commitdiff;h=f99163c6f… https://unix.stackexchange.com/questions/333539/lxterminal-in-the-netstat-o… https://bugs.debian.org/862098 https://security.archlinux.org/CVE-2016-10369

1 0

[arch-security] [ASA-201706-23] glibc: privilege escalation
by Levente Polyak 20 Jun '17

20 Jun '17

Arch Linux Security Advisory ASA-201706-23 ========================================== Severity: High Date : 2017-06-20 CVE-ID : CVE-2017-1000366 Package : glibc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-307 Summary ======= The package glibc before version 2.25-4 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.25-4. # pacman -Syu "glibc>=2.25-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult. Impact ====== A local attacker is able to execute arbitrary code on the affected host that is effectively leading to elevation of privileges by choosing a suitable target application. References ========== https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://security.archlinux.org/CVE-2017-1000366

1 0

[arch-security] [ASA-201706-22] lib32-glibc: privilege escalation
by Levente Polyak 20 Jun '17

20 Jun '17

Arch Linux Security Advisory ASA-201706-22 ========================================== Severity: High Date : 2017-06-20 CVE-ID : CVE-2017-1000366 Package : lib32-glibc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-308 Summary ======= The package lib32-glibc before version 2.25-4 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.25-4. # pacman -Syu "lib32-glibc>=2.25-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult. Impact ====== A local attacker is able to execute arbitrary code on the affected host that is effectively leading to elevation of privileges by choosing a suitable target application. References ========== https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://security.archlinux.org/CVE-2017-1000366

1 0

[arch-security] [ASA-201706-21] chromium: multiple issues
by Remi Gacogne 18 Jun '17

18 Jun '17

Arch Linux Security Advisory ASA-201706-21 ========================================== Severity: High Date : 2017-06-17 CVE-ID : CVE-2017-5087 CVE-2017-5088 CVE-2017-5089 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-304 Summary ======= The package chromium before version 59.0.3071.104-1 is vulnerable to multiple issues including information disclosure, sandbox escape and content spoofing. Resolution ========== Upgrade to 59.0.3071.104-1. # pacman -Syu "chromium>=59.0.3071.104-1" The problems have been fixed upstream in version 59.0.3071.104. Workaround ========== None. Description =========== - CVE-2017-5087 (sandbox escape) A sandbox escape vulnerability has been found in the IndexedDB component of the Chromium browser < 59.0.3071.104. - CVE-2017-5088 (information disclosure) An out-of-bounds read vulnerability has been found in the V8 component of the Chromium browser < 59.0.3071.104. - CVE-2017-5089 (content spoofing) A domain spoofing vulnerability has been found in the Omnibox component of the Chromium browser < 59.0.3071.104. Impact ====== A remote attacker can escape the sandbox, access sensitive information and trick the user into performing an unwanted action by spoofing the domain name. References ========== https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://crbug.com/725032 https://bugs.chromium.org/p/chromium/issues/detail?id=729991 https://bugs.chromium.org/p/chromium/issues/detail?id=714196 https://security.archlinux.org/CVE-2017-5087 https://security.archlinux.org/CVE-2017-5088 https://security.archlinux.org/CVE-2017-5089

1 0