- Arch-security - lists.archlinux.org

[arch-security] [ASA-201605-7] chromium: multiple issues
by Remi Gacogne 05 May '16

05 May '16

Arch Linux Security Advisory ASA-201605-7 ========================================= Severity: High Date : 2016-05-05 CVE-ID : CVE-2016-1660 CVE-2016-1661 CVE-2016-1662 CVE-2016-1663 CVE-2016-1664 CVE-2016-1665 CVE-2016-1666 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 50.0.2661.94-1 is vulnerable to multiple issues leading to denial of service, information leakage or arbitrary code execution. Resolution ========== Upgrade to 50.0.2661.94-1. # pacman -Syu "chromium>=50.0.2661.94-1" The problems have been fixed upstream in version 50.0.2661.94. Workaround ========== None. Description =========== - CVE-2016-1660: Out-of-bounds write in Blink. Credit to Atte Kettunen of OUSPG. - CVE-2016-1661: Memory corruption in cross-process frames. Credit to Wadih Matar. - CVE-2016-1662: Use-after-free in extensions. Credit to Rob Wu. - CVE-2016-1663: Use-after-free in Blink's V8 bindings. Credit to anonymous. - CVE-2016-1664: Address bar spoofing. Credit to Wadih Matar. - CVE-2016-1665: Information leak in V8. Credit to HyungSeok Han. - CVE-2016-1666: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can cause a denial of service, access sensitive information or possibly execute arbitrary code on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/04/stable-channel-update_28.ht… https://access.redhat.com/security/cve/CVE-2016-1660 https://access.redhat.com/security/cve/CVE-2016-1661 https://access.redhat.com/security/cve/CVE-2016-1662 https://access.redhat.com/security/cve/CVE-2016-1663 https://access.redhat.com/security/cve/CVE-2016-1664 https://access.redhat.com/security/cve/CVE-2016-1665 https://access.redhat.com/security/cve/CVE-2016-1666

1 0

[arch-security] [ASA-201605-6] imagemagick: arbitrary code execution
by Levente Polyak 05 May '16

05 May '16

Arch Linux Security Advisory ASA-201605-6 ========================================= Severity: Critical Date : 2016-05-05 CVE-ID : CVE-2016-3714 Package : imagemagick Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagick before version 6.9.3.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 6.9.3.10-1. # pacman -Syu "imagemagick>=6.9.3.10-1" The problem has been fixed upstream in version 6.9.3.10. Workaround ========== To prevent these possible exploits, simply add <policy domain="coder" rights="none" pattern="EPHEMERAL" /> <policy domain="coder" rights="none" pattern="HTTPS" /> <policy domain="coder" rights="none" pattern="MVG" /> <policy domain="coder" rights="none" pattern="MSL" /> <policy domain="coder" rights="none" pattern="TEXT" /> <policy domain="coder" rights="none" pattern="SHOW" /> <policy domain="coder" rights="none" pattern="WIN" /> <policy domain="coder" rights="none" pattern="PLT" /> to your policy.xml file. To mitigate the dangerous HTTPS delegate, you can also remove support for it by deleting it from the delegates.xml configuration file. Description =========== It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. Impact ====== A remote attacker is able to use a specially crafted image file that, when processed, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-3714 https://bugs.archlinux.org/task/49203 https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 https://imagetragick.com/

1 0

[arch-security] [ASA-201605-5] quassel-core: denial of service
by Christian Rebischke 05 May '16

05 May '16

Arch Linux Security Advisory ASA-201605-5 ========================================= Severity: Medium Date : 2016-05-05 CVE-ID : CVE-2016-4414 Package : quassel-core Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package quassel-core before version 0.12.4-1 is vulnerable to denial of service attack by unauthenticated clients. Resolution ========== Upgrade to 0.12.4-1. # pacman -Syu "quassel-core>=0.12.4-1" The problem has been fixed upstream in version 0.12.4. Workaround ========== None. Description =========== - CVE-2016-4414 (denial of service) It was found that quasselcore is vulnerable to a denial of service attack by unauthenticated clients. The protocol negotiation did not take into account lack of a match, in which case PeerFactory::createPeer returns a nullptr, which is immediately dereferenced. Impact ====== A remote attacker is able to crash the quassel-core with an unauthenticated client. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4414 https://marc.info/?l=oss-security&m=146204310020229&w=2 https://github.com/quassel/quassel/commit/e67887343c433cc35bc26ad6a9392588f…

1 0

[arch-security] [ASA-201605-4] lib32-openssl: multiple issues
by Remi Gacogne 04 May '16

04 May '16

Arch Linux Security Advisory ASA-201605-4 ========================================= Severity: High Date : 2016-05-04 CVE-ID : CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176 Package : lib32-openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-openssl before version 1:1.0.2.h-1 is vulnerable to multiple issues leading to man-in-the-middle or possibly arbitrary code execution. Resolution ========== Upgrade to 1:1.0.2.h-1. # pacman -Syu "lib32-openssl>=1:1.0.2.h-1" The problem has been fixed upstream in version 1.0.2h. Workaround ========== None. Description =========== - CVE-2016-2105 (buffer overflow): An overflow can occur in the EVP_EncodeUpdate() function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. Internally to OpenSSL the EVP_EncodeUpdate() function is primarily used by the PEM_write_bio* family of functions. These are mainly used within the OpenSSL command line applications. These internal uses are not considered vulnerable because all calls are bounded with length checks so no overflow is possible. User applications that call these APIs directly with large amounts of untrusted data may be vulnerable. (Note: Initial analysis suggested that the PEM_write_bio* were vulnerable, and this is reflected in the patch commit message. This is no longer believed to be the case). - CVE-2016-2106 (buffer overflow): An overflow can occur in the EVP_EncryptUpdate() function. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. Following an analysis of all OpenSSL internal usage of the EVP_EncryptUpdate() function all usage is one of two forms. The first form is where the EVP_EncryptUpdate() call is known to be the first called function after an EVP_EncryptInit(), and therefore that specific call must be safe. The second form is where the length passed to EVP_EncryptUpdate() can be seen from the code to be some small value and therefore there is no possibility of an overflow. Since all instances are one of these two forms, it is believed that there can be no overflows in internal code due to this problem. It should be noted that EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths. Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances of these calls have also been analysed too and it is believed there are no instances in internal usage where an overflow could occur. This could still represent a security issue for end user code that calls this function directly. - CVE-2016-2107 (man-in-the-middle): A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes. - CVE-2016-2109 (memory exhaustion): When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio() a short invalid encoding can cause allocation of large amounts of memory potentially consuming excessive resources or exhausting memory. Any application parsing untrusted data through d2i BIO functions is affected. The memory based functions such as d2i_X509() are *not* affected. Since the memory based functions are used by the TLS library, TLS applications are not affected. - CVE-2016-2176 (information leak): ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer. Impact ====== A remote attacker might be able to do a man-in-the-middle attack, access sensitive information, cause a crash or execute arbitrary code on the affected host. References ========== https://www.openssl.org/news/secadv/20160503.txt https://access.redhat.com/security/cve/CVE-2016-2105 https://access.redhat.com/security/cve/CVE-2016-2106 https://access.redhat.com/security/cve/CVE-2016-2107 https://access.redhat.com/security/cve/CVE-2016-2109 https://access.redhat.com/security/cve/CVE-2016-2176

1 0

[arch-security] [ASA-201605-3] openssl: multiple issues
by Remi Gacogne 04 May '16

04 May '16

Arch Linux Security Advisory ASA-201605-3 ========================================= Severity: High Date : 2016-05-04 CVE-ID : CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176 Package : openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.h-1 is vulnerable to multiple issues leading to man-in-the-middle or possibly arbitrary code execution. Resolution ========== Upgrade to 1.0.2.h-1. # pacman -Syu "openssl>=1.0.2.h-1" The problem has been fixed upstream in version 1.0.2.h. Workaround ========== None. Description =========== - CVE-2016-2105 (buffer overflow): An overflow can occur in the EVP_EncodeUpdate() function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. Internally to OpenSSL the EVP_EncodeUpdate() function is primarily used by the PEM_write_bio* family of functions. These are mainly used within the OpenSSL command line applications. These internal uses are not considered vulnerable because all calls are bounded with length checks so no overflow is possible. User applications that call these APIs directly with large amounts of untrusted data may be vulnerable. (Note: Initial analysis suggested that the PEM_write_bio* were vulnerable, and this is reflected in the patch commit message. This is no longer believed to be the case). - CVE-2016-2106 (buffer overflow): An overflow can occur in the EVP_EncryptUpdate() function. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. Following an analysis of all OpenSSL internal usage of the EVP_EncryptUpdate() function all usage is one of two forms. The first form is where the EVP_EncryptUpdate() call is known to be the first called function after an EVP_EncryptInit(), and therefore that specific call must be safe. The second form is where the length passed to EVP_EncryptUpdate() can be seen from the code to be some small value and therefore there is no possibility of an overflow. Since all instances are one of these two forms, it is believed that there can be no overflows in internal code due to this problem. It should be noted that EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths. Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances of these calls have also been analysed too and it is believed there are no instances in internal usage where an overflow could occur. This could still represent a security issue for end user code that calls this function directly. - CVE-2016-2107 (man-in-the-middle): A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes. - CVE-2016-2109 (memory exhaustion): When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio() a short invalid encoding can cause allocation of large amounts of memory potentially consuming excessive resources or exhausting memory. Any application parsing untrusted data through d2i BIO functions is affected. The memory based functions such as d2i_X509() are *not* affected. Since the memory based functions are used by the TLS library, TLS applications are not affected. - CVE-2016-2176 (information leak): ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer. Impact ====== A remote attacker might be able to do a man-in-the-middle attack, access sensitive information, cause a crash or execute arbitrary code on the affected host. References ========== https://www.openssl.org/news/secadv/20160503.txt https://access.redhat.com/security/cve/CVE-2016-2105 https://access.redhat.com/security/cve/CVE-2016-2106 https://access.redhat.com/security/cve/CVE-2016-2107 https://access.redhat.com/security/cve/CVE-2016-2109 https://access.redhat.com/security/cve/CVE-2016-2176

1 0

[arch-security] [ASA-201605-2] jasper: multiple issues
by Levente Polyak 04 May '16

04 May '16

Arch Linux Security Advisory ASA-201605-2 ========================================= Severity: High Date : 2016-05-04 CVE-ID : CVE-2016-1577 CVE-2016-2089 CVE-2016-2116 Package : jasper Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jasper before version 1.900.1-15 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.900.1-15. # pacman -Syu "jasper>=1.900.1-15" The problems have not been fixed upstream but patches were applied. Workaround ========== None. Description =========== - CVE-2016-1577 (arbitrary code execution) Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file. - CVE-2016-2089 (denial of service) The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. - CVE-2016-2116 (denial of service) Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file. Impact ====== A remote attacker is able to use a specially crafted image file that, when processed, is leading to denial of service or arbitrary code execution. References ========== https://bugs.archlinux.org/task/48511 https://access.redhat.com/security/cve/CVE-2016-1577 https://access.redhat.com/security/cve/CVE-2016-2089 https://access.redhat.com/security/cve/CVE-2016-2116

1 0

[arch-security] [ASA-201605-1] imlib2: multiple issues
by Levente Polyak 04 May '16

04 May '16

Arch Linux Security Advisory ASA-201605-1 ========================================= Severity: High Date : 2016-05-01 CVE-ID : CVE-2011-5326 CVE-2016-3993 CVE-2016-3994 CVE-2016-4024 Package : imlib2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imlib2 before version 1.4.9-1 is vulnerable to multiple issues that can lead to information leakage, application crash or arbitrary code execution. Resolution ========== Upgrade to 1.4.9-1. # pacman -Syu "imlib2>=1.4.9-1" The problems have been fixed upstream in version 1.4.9. Workaround ========== None. Description =========== - CVE-2011-5326 (denial of service) Kevin Ryde discovered that attempting to draw a 2x1 radi ellipse results in a floating point exception. - CVE-2016-3993 (information leakage) Yuriy M. Kaminskiy discovered that drawing using coordinates from an untrusted source could lead to an out-of-bound memory read, which in turn could result in an application crash. - CVE-2016-3994 (information Leakage) Jakub Wilk discovered that a malformed image could lead to an out-of-bound read in the GIF loader, which may result in an application crash or information leak. - CVE-2016-4024 (arbitrary code execution) Yuriy M. Kaminskiy discovered an integer overflow that could lead to an insufficient heap allocation and out-of-bound memory write. Impact ====== An attacker can leverage vulnerable library calls in imlib2 to crash an application, or read/write to the application's memory. This can lead to potential information leak or modification of the application's flow. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5326 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3993 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3994 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4021 http://article.gmane.org/gmane.comp.window-managers.enlightenment.devel/643… http://article.gmane.org/gmane.comp.security.oss.general/19276

1 0

[arch-security] [ASA-201604-15] firefox: multiple issues
by Remi Gacogne 30 Apr '16

30 Apr '16

Arch Linux Security Advisory ASA-201604-15 ========================================== Severity: Critical Date : 2016-04-30 CVE-ID : CVE-2016-2804 CVE-2016-2805 CVE-2016-2806 CVE-2016-2807 CVE-2016-2808 CVE-2016-2811 CVE-2016-2812 CVE-2016-2814 CVE-2016-2816 CVE-2016-2817 CVE-2016-2820 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 46.0-2 is vulnerable to multiple issues, up to arbitrary code execution. Resolution ========== Upgrade to 46.0-2. # pacman -Syu "firefox>=46.0-2" The problem has been fixed upstream in version 46.0. Workaround ========== None. Description =========== - CVE-2016-2804: Gary Kwong, Christian Holler, Andrew McCreight, Boris Zbarsky, and Steve Fink reported memory safety problems and crashes that are fixed in Firefox 46. - CVE-2016-2805: Christian Holler reported a memory safety problem that is fixed in Firefox ESR 38.8. - CVE-2016-2806: Gary Kwong, Christian Holler, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, and Randell Jesup reported memory safety problems and crashes that are fixed in Firefox ESR 45.1 and Firefox 46. - CVE-2016-2807: Christian Holler, Tyson Smith, and Phil Ringalda reported memory safety problems and crashes that are fixed in Firefox ESR 45.1, Firefox ESR 38.8 and Firefox 46. - CVE-2016-2808: The CESG, the Information Security Arm of GCHQ, reported that the JavaScript .watch() method could be used to overflow the 32-bit generation count of the underlying HashMap, resulting in a write to an invalid entry. Under the right conditions this write could lead to arbitrary code execution. The overflow takes considerable time and a malicious page would require a user to keep it open for the duration of the attack. - CVE-2016-2811, CVE-2016-2812: Security researcher Looben Yang reported two issues discovered in Service Workers using Address Sanitizer. The first of these is a use-after-free vulnerability caused by a ServiceWorkerInfo object being kept active beyond the life its owning registration. When it is later called through this registration, a use-after-free results. In the second issue, a race condition leading to a buffer overflow was found in the ServiceWorkerManager. This leads to a potentially exploitable crash when triggered. - CVE-2016-2814: Using Address Sanitizer, security researcher Sascha Just reported a buffer overflow in the libstagefright library due to issues with the handling of CENC offsets and the sizes table. This results in a potentially exploitable crash triggerable through web content. - CVE-2016-2816: Security researcher Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd. reported that Content Security Policy (CSP) is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. This allows for script to run in instances where CSP should block it, leading to a failure to prevent potential cross-site scripting (XSS) and other attacks against the web page. - CVE-2016-2817: Security researcher Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd. reported that the chrome.tabs.update API for web extensions allows for navigation to javascript: URLs without additional permissions. This can used to elevate privilege for a universal cross-site scripting (XSS) attack by a malicious web extension. It can also be used to inject content into other extensions if they load content within browser tabs. - CVE-2016-2820: Mozilla engineer Mark Goodwin discovered that the Firefox Health Report (about:healthreport) accepts certain events from any content document present in the remote-report iframe. If there were another vulnerability that allowed the injection of web content into the Firefox Health Report iframe, this content could change the sharing preferences of a user by firing the appropriate events at it s containing page. Impact ====== A remote attacker can bypass security policies, cause a denial of service or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://www.mozilla.org/en-US/security/advisories/mfsa2016-39/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-42/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-44/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-45/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-46/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-47/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-48/ https://access.redhat.com/security/cve/CVE-2016-2804 https://access.redhat.com/security/cve/CVE-2016-2805 https://access.redhat.com/security/cve/CVE-2016-2806 https://access.redhat.com/security/cve/CVE-2016-2807 https://access.redhat.com/security/cve/CVE-2016-2808 https://access.redhat.com/security/cve/CVE-2016-2811 https://access.redhat.com/security/cve/CVE-2016-2812 https://access.redhat.com/security/cve/CVE-2016-2814 https://access.redhat.com/security/cve/CVE-2016-2816 https://access.redhat.com/security/cve/CVE-2016-2817 https://access.redhat.com/security/cve/CVE-2016-2820

1 0

[arch-security] [ASA-201604-14] squid: multiple issues
by Levente Polyak 23 Apr '16

23 Apr '16

Arch Linux Security Advisory ASA-201604-14 ========================================== Severity: Critical Date : 2016-04-23 CVE-ID : CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 Package : squid Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.17-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 3.5.17-1. # pacman -Syu "squid>=3.5.17-1" The problems have been fixed upstream in version 3.5.17. Workaround ========== None. Description =========== - CVE-2016-4051 (denial of service) Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid. - CVE-2016-4052 (denial of service) Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses. - CVE-2016-4053 (information disclosure) Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses. - CVE-2016-4054 (arbitrary code execution) Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses. Impact ====== A remote attacker is able to execute arbitrary code, disclose sensitive information or perform a denial of service attack via multiple vulnerabilities. References ========== http://www.squid-cache.org/Advisories/SQUID-2016_5.txt http://www.squid-cache.org/Advisories/SQUID-2016_6.txt https://access.redhat.com/security/cve/CVE-2016-4051 https://access.redhat.com/security/cve/CVE-2016-4052 https://access.redhat.com/security/cve/CVE-2016-4053 https://access.redhat.com/security/cve/CVE-2016-4054

1 0

[arch-security] [ASA-201604-13] samba: multiple issues
by Levente Polyak 23 Apr '16

23 Apr '16

Arch Linux Security Advisory ASA-201604-13 ========================================== Severity: High Date : 2016-04-23 CVE-ID : CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 Package : samba Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package samba before version 4.4.2-1 is vulnerable to multiple issues including but not limited to denial of service, man-in-the-middle, information disclosure and possibly arbitrary code execution. Resolution ========== Upgrade to 4.4.2-1. # pacman -Syu "samba>=4.4.2-1" The problems have been fixed upstream in version 4.4.2-1. Workaround ========== None. Description =========== - CVE-2015-5370 (arbitrary code execution) Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC). - CVE-2016-2110 (man-in-the-middle) Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection. - CVE-2016-2111 (information disclosure) An authentication flaw was found in Samba. When Samba is configured to act as a Domain Controller, it allows remote attackers to spoof the computer name of a secure channel's endpoints. The attacker could exploit this flaw to obtain sensitive session information by running a crafted application and leveraging the ability to sniff network traffic. - CVE-2016-2112 (man-in-the-middle) It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections. - CVE-2016-2113 (man-in-the-middle) It was found that while having a support for TLS/SSL for some protocols like ldap and http, certificates are not validated at all. When having a "tls cafile" option, configured certificate is not used to validate the server certificate. - CVE-2016-2114 (man-in-the-middle) It was found that Samba based active directory domain controller does not enforce smb signing and opens possibility for man-in-the-middle attacks. When Samba is configured as a Domain Controller, the default for the "server signing" should be "mandatory". During the early development of Samba 4 a new experimental file server located under source4/smb_server was used. But before the final 4.0.0 release upstream switched back to the file server under source3/smbd. But the logic for the correct default of "server signing" was not ported. - CVE-2016-2115 (man-in-the-middle) It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client. - CVE-2016-2118 (man-in-the-middle) It was reported that various samba versions are vulnerable to man in the middle attack where attacker can intercept any DCERPC traffic between a client and a server in order to impersonate the client and get the same privileges as the authenticated user account. This is most problematic against active directory domain controllers. Impact ====== A remote attacker on the same network is able to perform a man-in-the-middle and denial of service attack, disclose sensitive information and, under certain circumstances, possibly execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2015-5370 https://access.redhat.com/security/cve/CVE-2016-2110 https://access.redhat.com/security/cve/CVE-2016-2111 https://access.redhat.com/security/cve/CVE-2016-2112 https://access.redhat.com/security/cve/CVE-2016-2113 https://access.redhat.com/security/cve/CVE-2016-2114 https://access.redhat.com/security/cve/CVE-2016-2115 https://access.redhat.com/security/cve/CVE-2016-2118 https://www.samba.org/samba/security/CVE-2015-5370.html https://www.samba.org/samba/security/CVE-2016-2110.html https://www.samba.org/samba/security/CVE-2016-2111.html https://www.samba.org/samba/security/CVE-2016-2112.html https://www.samba.org/samba/security/CVE-2016-2113.html https://www.samba.org/samba/security/CVE-2016-2114.html https://www.samba.org/samba/security/CVE-2016-2115.html https://www.samba.org/samba/security/CVE-2016-2118.html

1 0