- Arch-security - lists.archlinux.org

[arch-security] [ASA-201602-4] lib32-curl: authentication bypass
by Levente Polyak 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-4 ========================================= Severity: Low Date : 2016-02-02 CVE-ID : CVE-2016-0755 Package : lib32-curl Type : authentication bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-curl before version 7.47.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 7.47.0-1. # pacman -Syu "lib32-curl>=7.47.0-1" The problem has been fixed upstream in version 7.47.0. Workaround ========== None. Description =========== A vulnerability was found in a way libcurl uses NTLM-authenticated proxy connections. Libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. Since NTLM-based authentication is connection oriented instead of request oriented as other HTTP based authentication, it is important that only connections that have been authenticated with the correct username + password are reused. This was done properly for server connections already, but libcurl failed to do it properly for proxy connections using NTLM, which might allow remote attackers to authenticate as other users via a request. Impact ====== A remote attacker is able to authenticate as other users via a request without providing any NTLM credentials. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0755 http://curl.haxx.se/docs/adv_20160127A.html

1 0

[arch-security] [ASA-201602-3] curl: authentication bypass
by Levente Polyak 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-3 ========================================= Severity: Low Date : 2016-02-02 CVE-ID : CVE-2016-0755 Package : curl Type : authentication bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.47.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 7.47.0-1. # pacman -Syu "curl>=7.47.0-1" The problem has been fixed upstream in version 7.47.0. Workaround ========== None. Description =========== A vulnerability was found in a way libcurl uses NTLM-authenticated proxy connections. Libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. Since NTLM-based authentication is connection oriented instead of request oriented as other HTTP based authentication, it is important that only connections that have been authenticated with the correct username + password are reused. This was done properly for server connections already, but libcurl failed to do it properly for proxy connections using NTLM, which might allow remote attackers to authenticate as other users via a request. Impact ====== A remote attacker is able to authenticate as other users via a request without providing any NTLM credentials. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0755 http://curl.haxx.se/docs/adv_20160127A.html

1 0

[arch-security] [ASA-201602-2] python2-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-2 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python2-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python2-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201602-1] python2-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-1 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python2-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python2-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201602-1] python-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-1 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201601-33] lib32-openssl: man-in-the-middle
by Levente Polyak 29 Jan '16

29 Jan '16

Arch Linux Security Advisory ASA-201601-33 ========================================== Severity: High Date : 2016-01-29 CVE-ID : CVE-2015-3197 CVE-2015-4000 CVE-2016-0701 Package : lib32-openssl Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-openssl before version 1.0.2.f-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1.0.2.f-1. # pacman -Syu "lib32-openssl>=1.0.2.f-1" The problems have been fixed upstream in version 1.0.2.f. Workaround ========== None. Description =========== - CVE-2015-3197 (man-in-the-middle) A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. - CVE-2015-4000 (man-in-the-middle) A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic. - CVE-2016-0701 (man-in-the-middle) It was found that OpenSSL used weak Diffie-Hellman parameters based on unsafe primes, which were generated and stored in X9.42-style parameter files. An attacker who could force the peer to perform multiple handshakes using the same private DH component could use this flaw to conduct man-in-the-middle attacks on the SSL/TLS connection. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-3197 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2016-0701 https://openssl.org/news/secadv/20160128.txt

1 0

[arch-security] [ASA-201601-32] openssl: man-in-the-middle
by Levente Polyak 29 Jan '16

29 Jan '16

Arch Linux Security Advisory ASA-201601-32 ========================================== Severity: High Date : 2016-01-29 CVE-ID : CVE-2015-3197 CVE-2015-4000 CVE-2016-0701 Package : openssl Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.f-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1.0.2.f-1. # pacman -Syu "openssl>=1.0.2.f-1" The problems have been fixed upstream in version 1.0.2.f. Workaround ========== None. Description =========== - CVE-2015-3197 (man-in-the-middle) A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. - CVE-2015-4000 (man-in-the-middle) A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic. - CVE-2016-0701 (man-in-the-middle) It was found that OpenSSL used weak Diffie-Hellman parameters based on unsafe primes, which were generated and stored in X9.42-style parameter files. An attacker who could force the peer to perform multiple handshakes using the same private DH component could use this flaw to conduct man-in-the-middle attacks on the SSL/TLS connection. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-3197 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2016-0701 https://openssl.org/news/secadv/20160128.txt

1 0

[arch-security] [ASA-201601-31] nginx: denial of service
by Christian Rebischke 27 Jan '16

27 Jan '16

Arch Linux Security Advisory ASA-201601-31 ========================================== Severity: Medium Date : 2016-01-27 CVE-ID : CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 Package : nginx Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nginx before version 1.8.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.8.1-1 # pacman -Syu "nginx>=1.8.1-1" The problems have been fixed upstream in version 1.8.1. Workaround ========== None. Description =========== - CVE-2016-0742 (denial of service) Invalid pointer dereference might occur during DNS server response processing if the "resolver" directive was used, allowing an attacker who is able to forge UDP packets from the DNS server to cause segmentation fault in a worker process. - CVE-2016-0746 (denial of service) Use-after-free condition might occur during CNAME response processing if the "resolver" directive was used, allowing an attacker who is able to trigger name resolution to cause segmentation fault in a worker process, or might have potential other impact. - CVE-2016-0747 (denial of service) CNAME resolution was insufficiently limited if the "resolver" directive was used, allowing an attacker who is able to trigger arbitrary name resolution to cause excessive resource consumption in worker processes. Impact ====== A remote attacker is able to cause a segmentation fault and crash the server. References ========== http://mailman.nginx.org/pipermail/nginx-announce/2016/000168.html

1 0

[arch-security] [ASA-201601-30] blueman: privilege escalation
by Remi Gacogne 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-30 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2015-8612 Package : blueman Type : privilege escalation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package blueman before version 2.0.3-1 is vulnerable to local privilege escalation. Resolution ========== Upgrade to 2.0.3-1. # pacman -Syu "blueman>=2.0.3-1" The problem has been fixed upstream in version 2.0.3. Workaround ========== None. Description =========== A local privilege escalation vulnerability has been found in the Network::EnableNetwork() method of blueman. An unsanitized string is received over DBUS into the dhcp_handler parameter and passed to eval(), thus allowing arbitrary command execution with the privileges of the user running blueman. Impact ====== A local attacker can use this vulnerability to get root access on the affected host. References ========== https://bugs.archlinux.org/task/47784 https://access.redhat.com/security/cve/CVE-2015-8612 https://github.com/blueman-project/blueman/issues/416 https://github.com/blueman-project/blueman/commit/e3d249391654da3fefe08b538…

1 0

[arch-security] [ASA-201601-29] mbedtls: man-in-the-middle
by Remi Gacogne 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-29 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2015-7575 Package : mbedtls Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mbedtls before version 2.2.1-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 2.2.1-1. # pacman -Syu "mbedtls>=2.2.1-1" The problem has been fixed upstream in version 2.2.1. Workaround ========== None. Description =========== mbedTLS before 2.2.1 is vulnerable to the SLOTH attack, breaking MD5 signatures potentially used during TLS 1.2 handshakes to impersonate a TLS server. Impact ====== A remote attacker might be able to impersonate a TLS server, acting as a man-in-the-middle. References ========== https://bugs.archlinux.org/task/47783 https://access.redhat.com/security/cve/CVE-2015-7575 http://www.mitls.org/pages/attacks/SLOTH https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-p…

1 0