- Arch-security - lists.archlinux.org

[arch-security] [ASA-201608-10] jq: arbitrary code execution
by Remi Gacogne 10 Aug '16

10 Aug '16

Arch Linux Security Advisory ASA-201608-10 ========================================== Severity: High Date : 2016-08-10 CVE-ID : CVE-2015-8863 Package : jq Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jq before version 1.5-4 is vulnerable to a heap-based buffer overflow leading to arbitrary code execution. Resolution ========== Upgrade to 1.5-4. # pacman -Syu "jq>=1.5-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-based buffer overflow has been found in jq when parsing a JSON-encoded number longer than 256 bytes. The NULL-terminator byte was not allocated when the buffer was resized, causing a off-by-one write. Impact ====== A remote attacker can execute arbitrary code on the affected host by tricking a victim into processing a specially crafted JSON file. References ========== https://bugs.archlinux.org/task/50330 http://seclists.org/oss-sec/2016/q2/134 https://access.redhat.com/security/cve/CVE-2015-8863

1 0

[arch-security] [ASA-201608-9] curl: multiple issues
by Remi Gacogne 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-9 ========================================= Severity: Medium Date : 2016-08-08 CVE-ID : CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 Package : curl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.50.1-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 7.50.1-1. # pacman -Syu "curl>=7.50.1-1" The problems have been fixed upstream in version 7.50.1. Workaround ========== None. Description =========== - CVE-2016-5419 (authentication bypass) libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). - CVE-2016-5420 (authentication bypass) libcurl supports reuse of established connections for subsequent requests. It does this by keeping a few previous connections "alive" in a connection pool so that a subsequent request that can use one of them instead of creating a new connection will do so. When using a client certificate for a connection that was then put into the connection pool, that connection could then wrongly get reused in a subsequent request to that same server that either didn't use a client certificate at all or that asked to use a different client certificate thus trying to tell the user that it is a different entity. This mistakenly using the wrong connection could of course lead to applications sending requests to the wrong realms of the server using authentication that it wasn't supposed to have for those operations. - CVE-2016-5421 (arbitrary code execution) libcurl works with easy handles using the type 'CURL *' that are objects the application creates using curl_easy_init(). They are the handles that are all each associated with a single transfer at a time. libcurl also has an internal struct that represents and holds most state that is related to a single connection. An easy handle can hold references to one or many such connection structs depending on the requested operations. When using libcurl's multi interface, an application performs transfers by adding one or more easy handles to the multi handle and then it can drive all those transfers in parallel. Due to a flaw, libcurl could leave a pointer to a freed connection struct dangling in an easy handle that was previously added to a multi handle when curl_multi_cleanup() is called with an easy handle still added to it. This does not seem to cause any notable harm if the handle is then closed properly. However, if the easy handle would instead get used again with the easy interface and curl_easy_perform() to do another transfer, it would blindly use the connection struct pointer now pointing to freed memory. An application could be made to allocate its own fake version of the connect struct, fill in some data and then have the curl_easy_perform() call do something that clearly was not intended by the original code. Impact ====== A remote attacker might be able to bypass TLS client certificate authentication by tricking an application using libcurl into reusing an existing TLS session. A local attacker might be able to execute arbitrary code on the affected host by tricking an application using libcurl into reusing an easy handle. References ========== https://curl.haxx.se/docs/adv_20160803A.html https://curl.haxx.se/docs/adv_20160803B.html https://curl.haxx.se/docs/adv_20160803C.html https://access.redhat.com/security/cve/CVE-2016-5419 https://access.redhat.com/security/cve/CVE-2016-5420 https://access.redhat.com/security/cve/CVE-2016-5421

1 0

[arch-security] [ASA-201608-8] libupnp: arbitrary filesystem access
by Levente Polyak 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-8 ========================================= Severity: Medium Date : 2016-08-08 CVE-ID : CVE-2016-6255 Package : libupnp Type : arbitrary filesystem access Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libupnp before version 1.6.20-1 is vulnerable to arbitrary filesystem access. Resolution ========== Upgrade to 1.6.20-1. # pacman -Syu "libupnp>=1.6.20-1" The problem has been fixed upstream in version 1.6.20. Workaround ========== None. Description =========== A vulnerability was found in libupnp. If there's no registered handler for a POST or GET request, the default behavior is to write to or read from the filesystem. This allows an unauthenticated attacker to store or retrieve arbitrary data. This issue allows full host filesystem access if the process is running as root and using / as the web root. Impact ====== A remote attacker is able to read from or write to arbitrary files on the host filesystem via GET and POST requests. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6255 http://www.openwall.com/lists/oss-security/2016/07/18/13

1 0

[arch-security] [ASA-201608-7] lib32-glibc: denial of service
by Levente Polyak 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-7 ========================================= Severity: Low Date : 2016-08-08 CVE-ID : CVE-2016-3075 CVE-2016-5417 Package : lib32-glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.24-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.24-1. # pacman -Syu "lib32-glibc>=2.24-1" The problems have been fixed upstream in version 2.24. Workaround ========== None. Description =========== - CVE-2016-3075 (denial of service) The getnetbyname implementation in nss_dns contains a potentially unbounded alloca call (in the form of a call to strdupa), leading to a stack overflow (stack exhaustion) and a crash if getnetbyname is invoked on a very long name. - CVE-2016-5417 (denial of service) The sockaddr_in6 allocated in resolv/res_init.c:317 is not freed, leaking 28 bytes per thread using the resolver (according to valgrind). The leak is triggered if name resolution functions are called in such a way that internal resolver data structures are only initialized partially. This issue may ultimately lead to denial of service by leaking extensive amounts of memory. Impact ====== A remote attacker is able to perform a denial of service attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-3075 https://access.redhat.com/security/cve/CVE-2016-5417 https://sourceware.org/bugzilla/show_bug.cgi?id=19879 https://sourceware.org/bugzilla/show_bug.cgi?id=19257

1 0

[arch-security] [ASA-201608-6] glibc: denial of service
by Levente Polyak 08 Aug '16

08 Aug '16

Arch Linux Security Advisory ASA-201608-6 ========================================= Severity: Low Date : 2016-08-08 CVE-ID : CVE-2016-3075 CVE-2016-5417 Package : glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.24-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.24-1. # pacman -Syu "glibc>=2.24-1" The problems have been fixed upstream in version 2.24. Workaround ========== None. Description =========== - CVE-2016-3075 (denial of service) The getnetbyname implementation in nss_dns contains a potentially unbounded alloca call (in the form of a call to strdupa), leading to a stack overflow (stack exhaustion) and a crash if getnetbyname is invoked on a very long name. - CVE-2016-5417 (denial of service) The sockaddr_in6 allocated in resolv/res_init.c:317 is not freed, leaking 28 bytes per thread using the resolver (according to valgrind). The leak is triggered if name resolution functions are called in such a way that internal resolver data structures are only initialized partially. This issue may ultimately lead to denial of service by leaking extensive amounts of memory. Impact ====== A remote attacker is able to perform a denial of service attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-3075 https://access.redhat.com/security/cve/CVE-2016-5417 https://sourceware.org/bugzilla/show_bug.cgi?id=19879 https://sourceware.org/bugzilla/show_bug.cgi?id=19257

1 0

[arch-security] [ASA-201608-5] jre7-openjdk-headless: multiple issues
by Levente Polyak 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-5 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-3458 CVE-2016-3500 CVE-2016-3508 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Package : jre7-openjdk-headless Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk-headless before version 7.u111_2.6.7-1 is vulnerable to multiple issues including denial of service and sandbox restriction bypass. Resolution ========== Upgrade to 7.u111_2.6.7-1. # pacman -Syu "jre7-openjdk-headless>=7.u111_2.6.7-1" The problems have been fixed upstream in version 7.u111_2.6.7. Workaround ========== None. Description =========== - CVE-2016-3458 (sandbox restriction bypass) It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3500 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2016-3508 (denial of service) It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property. - CVE-2016-3550 (sandbox restriction bypass) Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3598 (sandbox restriction bypass) A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3606 (sandbox restriction bypass) It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3610 (sandbox restriction bypass) It was discovered that the filterReturnValue() method of the MethodHandles in the Libraries component of OpenJDK did not properly check filter MethodHandle parameter count. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker is able to perform a denial of service attack or bypass sandbox restrictions via various vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2016-July/036560.html https://access.redhat.com/security/cve/CVE-2016-3458 https://access.redhat.com/security/cve/CVE-2016-3500 https://access.redhat.com/security/cve/CVE-2016-3508 https://access.redhat.com/security/cve/CVE-2016-3550 https://access.redhat.com/security/cve/CVE-2016-3598 https://access.redhat.com/security/cve/CVE-2016-3606 https://access.redhat.com/security/cve/CVE-2016-3610

1 0

[arch-security] [ASA-201608-4] jre7-openjdk: multiple issues
by Levente Polyak 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-4 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-3458 CVE-2016-3500 CVE-2016-3508 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Package : jre7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u111_2.6.7-1 is vulnerable to multiple issues including denial of service and sandbox restriction bypass. Resolution ========== Upgrade to 7.u111_2.6.7-1. # pacman -Syu "jre7-openjdk>=7.u111_2.6.7-1" The problems have been fixed upstream in version 7.u111_2.6.7. Workaround ========== None. Description =========== - CVE-2016-3458 (sandbox restriction bypass) It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3500 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2016-3508 (denial of service) It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property. - CVE-2016-3550 (sandbox restriction bypass) Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3598 (sandbox restriction bypass) A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3606 (sandbox restriction bypass) It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3610 (sandbox restriction bypass) It was discovered that the filterReturnValue() method of the MethodHandles in the Libraries component of OpenJDK did not properly check filter MethodHandle parameter count. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker is able to perform a denial of service attack or bypass sandbox restrictions via various vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2016-July/036560.html https://access.redhat.com/security/cve/CVE-2016-3458 https://access.redhat.com/security/cve/CVE-2016-3500 https://access.redhat.com/security/cve/CVE-2016-3508 https://access.redhat.com/security/cve/CVE-2016-3550 https://access.redhat.com/security/cve/CVE-2016-3598 https://access.redhat.com/security/cve/CVE-2016-3606 https://access.redhat.com/security/cve/CVE-2016-3610

1 0

[arch-security] [ASA-201608-3] jdk7-openjdk: multiple issues
by Levente Polyak 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-3 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-3458 CVE-2016-3500 CVE-2016-3508 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Package : jdk7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk before version 7.u111_2.6.7-1 is vulnerable to multiple issues including denial of service and sandbox restriction bypass. Resolution ========== Upgrade to 7.u111_2.6.7-1. # pacman -Syu "jdk7-openjdk>=7.u111_2.6.7-1" The problems have been fixed upstream in version 7.u111_2.6.7. Workaround ========== None. Description =========== - CVE-2016-3458 (sandbox restriction bypass) It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3500 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2016-3508 (denial of service) It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property. - CVE-2016-3550 (sandbox restriction bypass) Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3598 (sandbox restriction bypass) A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3606 (sandbox restriction bypass) It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3610 (sandbox restriction bypass) It was discovered that the filterReturnValue() method of the MethodHandles in the Libraries component of OpenJDK did not properly check filter MethodHandle parameter count. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker is able to perform a denial of service attack or bypass sandbox restrictions via various vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2016-July/036560.html https://access.redhat.com/security/cve/CVE-2016-3458 https://access.redhat.com/security/cve/CVE-2016-3500 https://access.redhat.com/security/cve/CVE-2016-3508 https://access.redhat.com/security/cve/CVE-2016-3550 https://access.redhat.com/security/cve/CVE-2016-3598 https://access.redhat.com/security/cve/CVE-2016-3606 https://access.redhat.com/security/cve/CVE-2016-3610

1 0

[arch-security] [ASA-201608-2] firefox: multiple issues
by Jelle van der Waa 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-2 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-0718 CVE-2016-2830 CVE-2016-2835 CVE-2016-2836 CVE-2016-2837 CVE-2016-2838 CVE-2016-5250 CVE-2016-5251 CVE-2016-5252 CVE-2016-5254 CVE-2016-5255 CVE-2016-5258 CVE-2016-5259 CVE-2016-5260 CVE-2016-5261 CVE-2016-5262 CVE-2016-5263 CVE-2016-5264 CVE-2016-5265 CVE-2016-5266 CVE-2016-5268 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 48.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 48.0-1. # pacman -Syu "firefox>=48.0-1" The problems have been fixed upstream in version 48.0. Workaround ========== None. Description =========== - CVE-2016-0718 (arbitrary code execution) Out-of-bounds read during XML parsing in Expat library. - CVE-2016-2830 (information disclosure) Favicon network connection can persist when page is closed. - CVE-2016-2835 CVE-2016-2836 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-2837 (arbitrary code execution) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback - CVE-2016-2838 (arbitrary code execution) Buffer overflow rendering SVG with bidirectional content. - CVE-2016-5250 (information disclosure) Information disclosure through Resource Timing API during page navigation. - CVE-2016-5251 (URL spoofing) Location bar spoofing via data URLs with malformed/invalid mediatypes. - CVE-2016-5252 (arbitrary code execution) Stack underflow during 2D graphics rendering. - CVE-2016-5254 (arbitrary code execution) Use-after-free when using alt key and toplevel menus. - CVE-2016-5255 (arbitrary code execution) Crash in incremental garbage collection in JavaScript. - CVE-2016-5258 (arbitrary code execution) Use-after-free in DTLS during WebRTC session shutdown. - CVE-2016-5259 (arbitrary code execution) Use-after-free in service workers with nested sync events. - CVE-2016-5260 (information disclosure) Form input type change from password to text can store plain text password in session restore file. - CVE-2016-5261 (arbitrary code execution) Integer overflow in WebSockets during data buffering. - CVE-2016-5262 (cross-site scripting) Scripts on marquee tag can execute in sandboxed iframes. - CVE-2016-5263 (type confusion) Type confusion in display transformation - CVE-2016-5264 (use after free) Use-after-free when applying SVG effects. - CVE-2016-5265 (same-origin policy bypass) Same-origin policy violation using local HTML file and saved shortcut file. - CVE-2016-5266 (information disclosure) Information disclosure and local file manipulation through drag and drop. - CVE-2016-5268 (spoofing) Spoofing attack through text injection into internal error pages. Impact ====== A remote attacker can access sensitive information, bypass policies or execute arbitrary code on the affected host. References ========== https://access.redhat.com/security/cve/CVE-2016-0718 https://access.redhat.com/security/cve/CVE-2016-2830 https://access.redhat.com/security/cve/CVE-2016-2835 https://access.redhat.com/security/cve/CVE-2016-2836 https://access.redhat.com/security/cve/CVE-2016-2837 https://access.redhat.com/security/cve/CVE-2016-2838 https://access.redhat.com/security/cve/CVE-2016-5250 https://access.redhat.com/security/cve/CVE-2016-5251 https://access.redhat.com/security/cve/CVE-2016-5252 https://access.redhat.com/security/cve/CVE-2016-5254 https://access.redhat.com/security/cve/CVE-2016-5255 https://access.redhat.com/security/cve/CVE-2016-5258 https://access.redhat.com/security/cve/CVE-2016-5259 https://access.redhat.com/security/cve/CVE-2016-5260 https://access.redhat.com/security/cve/CVE-2016-5261 https://access.redhat.com/security/cve/CVE-2016-5262 https://access.redhat.com/security/cve/CVE-2016-5263 https://access.redhat.com/security/cve/CVE-2016-5264 https://access.redhat.com/security/cve/CVE-2016-5265 https://access.redhat.com/security/cve/CVE-2016-5266 https://access.redhat.com/security/cve/CVE-2016-5268 https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef…

1 0

[arch-security] [ASA-201608-1] openssh: information leakage
by Christian Rebischke 02 Aug '16

02 Aug '16

Arch Linux Security Advisory ASA-201608-1 ========================================= Severity: Medium Date : 2016-08-02 CVE-ID : CVE-2016-6210 Package : openssh Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 7.3p1-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.3p1-1. # pacman -Syu "openssh>=7.3p1-1" The problem has been fixed upstream in version 7.3p1. Workaround ========== None. Description =========== Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. Reported by EddieEzra.Harari at verint.com Impact ====== A remote attacker is able to enumerate users by sending large passwords. References ========== https://access.redhat.com/security/cve/CVE-2016-6210 http://seclists.org/fulldisclosure/2016/Jul/51 http://www.openssh.com/txt/release-7.3

1 0