- Arch-security - lists.archlinux.org

[arch-security] [ASA-201507-19] libuser: multiple issues
by Levente Polyak 24 Jul '15

24 Jul '15

Arch Linux Security Advisory ASA-201507-19 ========================================== Severity: Critical Date : 2015-07-24 CVE-ID : CVE-2015-3245 CVE-2015-3246 Package : libuser Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libuser before version 0.62-1 is vulnerable to privilege escalation and denial of service. Resolution ========== Upgrade to 0.62-1. # pacman -Syu "libuser>=0.62-1" The problems have been fixed upstream in version 0.62. Workaround ========== None. Description =========== - CVE-2015-3245 (denial of service) It was found that libuser, as used by the chfn userhelper functionality, did not properly filter out newline characters in GECOS fields. A local, authenticated user could use this flaw to corrupt the /etc/passwd file, resulting in a denial-of-service on the system. - CVE-2015-3246 (privilege escalation) A flaw was found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser (for example, userhelper) to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate their privileges to root. Impact ====== A local authenticated user is able to use an application compiled against libuser to escalate privileges to root or perform a denial-of-service attack on the system by corrupting the /etc/passwd file. References ========== http://seclists.org/oss-sec/2015/q3/185 https://access.redhat.com/security/cve/CVE-2015-3245 https://access.redhat.com/security/cve/CVE-2015-3246

1 0

[arch-security] [ASA-201507-17] openssh: authentication limits bypass
by Levente Polyak 23 Jul '15

23 Jul '15

Arch Linux Security Advisory ASA-201507-17 ========================================== Severity: Medium Date : 2015-07-23 CVE-ID : CVE-2015-5600 Package : openssh Type : authentication limits bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 6.9p1-2 is vulnerable to authentication limits bypass. Resolution ========== Upgrade to 6.9p1-2. # pacman -Syu "openssh>=6.9p1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== In case that public key authentication is properly configured and no challenge-response authentication is required, deactivating challenge-response and kbd-interactive authentication in /etc/ssh/sshd_config via the following property mitigates this issue: KbdInteractiveAuthentication no ChallengeResponseAuthentication no Description =========== The OpenSSH server normally wouldn't allow successive authentications that exceed the MaxAuthTries setting in sshd_config, however when using kbd-interactive challenge-response authentication the allowed login retries can be extended limited only by the LoginGraceTime setting, that can be more than 10000 tries (depends on the network speed), and even more for local attacks. Impact ====== A remote attacker is able to perform a brute-force attack by bypassing the authentication limits via keyboard-interactive challenge-response authentication. References ========== http://seclists.org/fulldisclosure/2015/Jul/92 https://access.redhat.com/security/cve/CVE-2015-5600

1 0

[arch-security] [ASA-201507-18] chromium: multiple issues
by Remi Gacogne 23 Jul '15

23 Jul '15

Arch Linux Security Advisory ASA-201507-18 ========================================== Severity: High Date : 2015-07-23 CVE-ID : CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273 CVE-2015-1274 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278 CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282 CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286 CVE-2015-1287 CVE-2015-1288 CVE-2015-1289 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 44.0.2403.89-1 is vulnerable to multiple issues including but not limited to denial of service, CSP and SOP bypass and spell-checking dictionaries hijack. Resolution ========== Upgrade to 44.0.2403.89-1. # pacman -Syu "chromium>=44.0.2403.89-1" The problem has been fixed upstream in version 44.0.2403.89. Workaround ========== None. Description =========== - CVE-2015-1270: Uninitialized memory read in ICU. - CVE-2015-1271: Heap overflow in pdfium. - CVE-2015-1272, CVE-2015-1273, CVE-2015-1279: Use-after-free related to unexpected GPU process termination. - CVE-2015-1274: Settings allowed executable files to run immediately after download. - CVE-2015-1276 : Use-after-free in IndexedDB. - CVE-2015-1277: Use-after-free in accessibility. - CVE-2015-1278: URL spoofing using pdf files. - CVE-2015-1280: Memory corruption in skia. - CVE-2015-1281: CSP bypass. - CVE-2015-1282: Use-after-free in pdfium. - CVE-2015-1283: Heap-buffer-overflow in expat. - CVE-2015-1284: Use-after-free in blink. - CVE-2015-1285: Information leak in XSS auditor. - CVE-2015-1286: UXSS in blink. - CVE-2015-1287: SOP bypass with CSS. - CVE-2015-1288: Spell checking dictionaries fetched over HTTP. - CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass the Same-Origin Policy or the Content Security Policy of a website, hijack spell-checking dictionaries, cause a denial of service or have other unspecified impact. References ========== http://googlechromereleases.blogspot.fr/2015/07/stable-channel-update_21.ht… https://access.redhat.com/security/cve/CVE-2015-1270 https://access.redhat.com/security/cve/CVE-2015-1271 https://access.redhat.com/security/cve/CVE-2015-1272 https://access.redhat.com/security/cve/CVE-2015-1273 https://access.redhat.com/security/cve/CVE-2015-1274 https://access.redhat.com/security/cve/CVE-2015-1276 https://access.redhat.com/security/cve/CVE-2015-1277 https://access.redhat.com/security/cve/CVE-2015-1278 https://access.redhat.com/security/cve/CVE-2015-1279 https://access.redhat.com/security/cve/CVE-2015-1280 https://access.redhat.com/security/cve/CVE-2015-1281 https://access.redhat.com/security/cve/CVE-2015-1282 https://access.redhat.com/security/cve/CVE-2015-1283 https://access.redhat.com/security/cve/CVE-2015-1284 https://access.redhat.com/security/cve/CVE-2015-1285 https://access.redhat.com/security/cve/CVE-2015-1286 https://access.redhat.com/security/cve/CVE-2015-1287 https://access.redhat.com/security/cve/CVE-2015-1288 https://access.redhat.com/security/cve/CVE-2015-1289

1 0

[arch-security] [ASA-201507-16] jre7-openjdk: multiple issues
by Remi Gacogne 22 Jul '15

22 Jul '15

Arch Linux Security Advisory ASA-201507-16 ========================================== Severity: Critical Date : 2015-07-22 CVE-ID : CVE-2015-2590 CVE-2015-2601 CVE-2015-2613 CVE-2015-2621 CVE-2015-2625 CVE-2015-2628 CVE-2015-2632 CVE-2015-2808 CVE-2015-4000 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Package : jre7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u85_2.6.1-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 7.u85_2.6.1-1. # pacman -Syu "jre7-openjdk>=7.u85_2.6.1-1" The problem has been fixed upstream in version 7.u85 of OpenJDK and 2.6.1 of IcedTea. Workaround ========== None. Description =========== - CVE-2015-2590 (deserialization issue in ObjectInputStream.readSerialData()): ObjectInputStream's readSerialData() could, in certain cases, incorrectly perform deserialization of data from serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-2601 (non-constant time comparisons in crypto code): It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons. - CVE-2015-2613 (NSS / JCE: missing EC parameter validation in ECDH_Derive()): It was discovered that the Elliptic Curve (EC) cryptography code as used in Mozilla NSS (Network Security Services) library and OpenJDK JCE (Java Cryptography Extension) component failed to properly validate EC parameters as used in ECDH_Derive() function, which performs ECDH (Elliptic Curve Diffie-Hellman) key derivation. A remote attacker could use this flaw to disclose sensitive information. - CVE-2015-2621 (incorrect code permission checks in RMIConnectionImpl): It was discovered that the RMIConnectionImpl class in the JMX component of OpenJDK failed to properly check code permissions when creating repository class loaders. An untrusted Java application or applet could use this flaw to read information access to which should be restricted by the Java sandbox, partially bypassing sandbox restrictions. - CVE-2015-2625 (name for reverse DNS lookup used in certificate identity check): A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identify verification when establishing TLS/SSL connection to a host identified using IP address. In certain cases, it would incorrectly use a host name obtained after performing reverse DNS lookup of the specified IP address rather than the original IP address for the identity check, possibly leading to having a certificate issued for different identity to be accepted as valid. This issue is know to affect cases when SSLSocketFactory.createSocket() is called with certain InetAddress instances. It is not known to affect cases when target host IP is passed to createSocket() as string, or when IP is used in URL used for HttpsURLConnection. With this patch, reverse DNS lookup is no longer performed. The fix also adds new system property jdk.tls.trustNameService that can be used to allow the DNS lookup to be performed and hence have its result used during identity check. - CVE-2015-2628 (IIOPInputStream type confusion vulnerability): It was discovered that the IIOPInputStream class in the CORBA component in OpenJDK failed to properly check object field types. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-2632 (integer overflow in LETableReference verifyLength()): An integer overflow flaw, leading to out-of-bounds read, was found in the LETableReference's verifyLength() method. A specially crafted file could cause an application using ICU to parse untrusted font files to perform an invalid memory access, leading to crash and possibly disclosure of portion of application memory. ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-2808 (prohibit RC4 cipher suites): It was discovered that the Invariance Weakness of the RC4 stream cipher could be used to recover plaintext from a TLS connection, when RC4 encryption is used. "The Invariance Weakness is an L-shape key pattern in RC4 keys, which once it exists in an RC4 key, preserves part of the state permutation intact throughout the initialization process. This intact part includes the least significant bits of the permutation, when processed by the PRGA algorithm, determines the least significant bits of the allegedly pseudo-random output stream along a long prefix of the stream." This can lead to significant leakage of plaintext bytes from the ciphertext. - CVE-2015-4000 (make jdk8 mode the default for jdk.tls.ephemeralDHKeySize): Prevent logjam attack TLS connections using Diffie-Hellman key exchange protocol were found to be vulnerable to an attack, in which a man-in-the-middle attacker could downgrade vulnerable TLS connections to 512-bit export-grade cryptography. The attack affects any server that supports DHE_EXPORT ciphers. - CVE-2015-4731 (improper permission checks in MBeanServerInvocationHandler): It was discovered that the JMX component in OpenJDK failed to properly handle MBean connection proxy classes. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4732 (insufficient context checks during object deserialization): It was discovered that the Libraries component of OpenJDK failed to check current context / thread while performing object deserialization, possibly leading to incorrect input deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4733 (RemoteObjectInvocationHandler allows calling finalize()): It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not prevent calls to the finalize() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4748 (incorrect OCSP nextUpdate checking): A flaw was found in the way the Libraries component of OpenJDK verified OCSP (Online Certificate Status Protocol) response. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity. This could allow a Java application to accept a revoked X.509 certificate as valid if it was presented with an OCSP response generated before certificate revocation. - CVE-2015-4749 (DnsClient fails to release request information after error): It was discovered that the DnsClient client class in the JNDI (Java Naming and Directory Interface) component in OpenJDK failed to properly remove information about an outgoing DNS request from the list of outstanding DNS requests when certain errors occurred during DNS resolution. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and possibly block further DNS resolution (after exhausting all DNS transaction ids). - CVE-2015-4760 (missing boundary checks in layout engine): It was discovered that ICU Layout Engine was missing multiple boundary checks. These could lead to buffer overflows and JVM memory corruption. A specially crafted file could cause an application using ICU to parse untrusted font files to crash and, possibly, execute arbitrary code. ICU code is embedded the 2D component in OpenJDK and used by FontManager. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker can execute arbitrary code on an affected host. References ========== http://blog.fuseyism.com/index.php/2015/07/21/security-icedtea-2-6-1-for-op… http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-updat… https://access.redhat.com/security/cve/CVE-2015-2590 https://access.redhat.com/security/cve/CVE-2015-2601 https://access.redhat.com/security/cve/CVE-2015-2613 https://access.redhat.com/security/cve/CVE-2015-2621 https://access.redhat.com/security/cve/CVE-2015-2625 https://access.redhat.com/security/cve/CVE-2015-2628 https://access.redhat.com/security/cve/CVE-2015-2632 https://access.redhat.com/security/cve/CVE-2015-2808 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2015-4731 https://access.redhat.com/security/cve/CVE-2015-4732 https://access.redhat.com/security/cve/CVE-2015-4733 https://access.redhat.com/security/cve/CVE-2015-4748 https://access.redhat.com/security/cve/CVE-2015-4749 https://access.redhat.com/security/cve/CVE-2015-4760

1 0

[arch-security] [ASA-201507-15] apache: multiple issues
by Remi Gacogne 17 Jul '15

17 Jul '15

Arch Linux Security Advisory ASA-201507-15 ========================================== Severity: Medium Date : 2015-07-17 CVE-ID : CVE-2015-0228 CVE-2015-0253 CVE-2015-3183 CVE-2015-3185 Package : apache Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package apache before version 2.4.16-1 is vulnerable to multiple issues including remote denial of service and authentication bypass. Resolution ========== Upgrade to 2.4.16-1. # pacman -Syu "apache>=2.4.16-1" The problem has been fixed upstream in version 2.4.16. Workaround ========== None. Description =========== - CVE-2015-0228 (denial of service): mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash. - CVE-2015-0253 (denial of service): Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in 2.4.11. PR 57531. - CVE-2015-3183 (denial of service): core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters. - CVE-2015-3185 (authentication bypass): Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook. Impact ====== A remote attacker might be able to bypass authentication required by a module incorrectly updated for 2.4.x, or crash the apache httpd server. References ========== https://access.redhat.com/security/cve/CVE-2015-0228 https://access.redhat.com/security/cve/CVE-2015-0253 https://access.redhat.com/security/cve/CVE-2015-3183 https://access.redhat.com/security/cve/CVE-2015-3185 http://www.apache.org/dist/httpd/CHANGES_2.4.16 https://bz.apache.org/bugzilla/show_bug.cgi?id=57531

1 0

[arch-security] [ASA-201507-14] lib32-flashplugin: arbitrary code execution
by Levente Polyak 16 Jul '15

16 Jul '15

Arch Linux Security Advisory ASA-201507-14 ========================================== Severity: Critical Date : 2015-07-16 CVE-ID : CVE-2015-5122 CVE-2015-5123 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.491-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.491-1. # pacman -Syu "lib32-flashplugin>=11.2.202.491-1" The problems have been fixed upstream in version 11.2.202.491. Workaround ========== None. Description =========== - CVE-2015-5122 (arbitrary code execution) Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property. - CVE-2015-5123 (arbitrary code execution) Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function. Impact ====== A remote attacker is able to use a specially crafted flash application to execute arbitrary code. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-18.html https://access.redhat.com/security/cve/CVE-2015-5122 https://access.redhat.com/security/cve/CVE-2015-5123

1 0

[arch-security] [ASA-201507-13] flashplugin: arbitrary code execution
by Levente Polyak 16 Jul '15

16 Jul '15

Arch Linux Security Advisory ASA-201507-13 ========================================== Severity: Critical Date : 2015-07-16 CVE-ID : CVE-2015-5122 CVE-2015-5123 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.491-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.491-1. # pacman -Syu "flashplugin>=11.2.202.491-1" The problems have been fixed upstream in version 11.2.202.491. Workaround ========== None. Description =========== - CVE-2015-5122 (arbitrary code execution) Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property. - CVE-2015-5123 (arbitrary code execution) Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function. Impact ====== A remote attacker is able to use a specially crafted flash application to execute arbitrary code. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-18.html https://access.redhat.com/security/cve/CVE-2015-5122 https://access.redhat.com/security/cve/CVE-2015-5123

1 0

[arch-security] [ASA-201507-12] lib32-openssl: man-in-the-middle
by Levente Polyak 13 Jul '15

13 Jul '15

Arch Linux Security Advisory ASA-201507-12 ========================================== Severity: High Date : 2015-07-13 CVE-ID : CVE-2015-1793 Package : lib32-openssl Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-openssl before version 1.0.2.d-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1.0.2.d-1. # pacman -Syu "lib32-openssl>=1.0.2.d-1" The problem has been fixed upstream in version 1.0.2.d. Workaround ========== None. Description =========== During certificate verification, OpenSSL will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate. This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication. Impact ====== A remote attacker is able to use a valid leaf certificate to act as a CA and "issue" an invalid certificate that behaves valid to possibly perform a man-in-the-middle attack. References ========== https://openssl.org/news/secadv_20150709.txt https://access.redhat.com/security/cve/CVE-2015-1793

1 0

[arch-security] [ASA-201507-11] lib32-krb5: multiple issues
by Levente Polyak 12 Jul '15

12 Jul '15

Arch Linux Security Advisory ASA-201507-11 ========================================== Severity: Medium Date : 2015-07-12 CVE-ID : CVE-2014-5355 CVE-2015-2694 Package : lib32-krb5 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-krb5 before version 1.13.2-2 is vulnerable to multiple issues including denial of service and preauthentication requirement bypass. Resolution ========== Upgrade to 1.13.2-2. # pacman -Syu "lib32-krb5>=1.13.2-2" The problems have been fixed upstream in version 1.13.2. Workaround ========== None. Description =========== - CVE-2014-5355 (denial of service) When a server process uses the krb5_recvauth function, an unauthenticated remote attacker can cause a NULL dereference by sending a zero-byte version string, or a read beyond the end of allocated storage by sending a non-null-terminated version string. The example user-to-user server application (uuserver) is similarly vulnerable to a zero-length or non-null-terminated principal name string. The krb5_recvauth function reads two version strings from the client using krb5_read_message(), which produces a krb5_data structure containing a length and a pointer to an octet sequence. krb5_recvaut assumes that the data pointer is a valid C string and passes it to strcmp() to verify the versions. If the client sends an empty octet sequence, the data pointer will be NULL and strcmp() will dereference a NULL pointer, causing the process to crash. If the client sends a non-null-terminated octet sequence, strcmp() will read beyond the end of the allocated storage, possibly causing the process to crash. - CVE-2015-2694 (preauthentication requirement bypass) It has been discovered that, when the KDC is configured with PKINIT support, an unauthenticated remote attacker can bypass the requires_preauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line dictionary attack against the user's password. Impact ====== A remote attacker is able to send specially crafted packets to perform a denial of service attack or bypass the requires_preauth flag and obtain ciphertext that could be used to conduct an off-line dictionary attack against the user's password. References ========== https://krbdev.mit.edu/rt/Ticket/Display.html?id=8050 https://krbdev.mit.edu/rt/Ticket/Display.html?id=8160 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5355 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2694 https://bugs.archlinux.org/task/45575

1 0

[arch-security] [ASA-201507-10] krb5: multiple issues
by Levente Polyak 12 Jul '15

12 Jul '15

Arch Linux Security Advisory ASA-201507-10 ========================================== Severity: Medium Date : 2015-07-12 CVE-ID : CVE-2014-5355 CVE-2015-2694 Package : krb5 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package krb5 before version 1.13.2-1 is vulnerable to multiple issues including denial of service and preauthentication requirement bypass. Resolution ========== Upgrade to 1.13.2-1. # pacman -Syu "krb5>=1.13.2-1" The problems have been fixed upstream in version 1.13.2. Workaround ========== None. Description =========== - CVE-2014-5355 (denial of service) When a server process uses the krb5_recvauth function, an unauthenticated remote attacker can cause a NULL dereference by sending a zero-byte version string, or a read beyond the end of allocated storage by sending a non-null-terminated version string. The example user-to-user server application (uuserver) is similarly vulnerable to a zero-length or non-null-terminated principal name string. The krb5_recvauth function reads two version strings from the client using krb5_read_message(), which produces a krb5_data structure containing a length and a pointer to an octet sequence. krb5_recvaut assumes that the data pointer is a valid C string and passes it to strcmp() to verify the versions. If the client sends an empty octet sequence, the data pointer will be NULL and strcmp() will dereference a NULL pointer, causing the process to crash. If the client sends a non-null-terminated octet sequence, strcmp() will read beyond the end of the allocated storage, possibly causing the process to crash. - CVE-2015-2694 (preauthentication requirement bypass) It has been discovered that, when the KDC is configured with PKINIT support, an unauthenticated remote attacker can bypass the requires_preauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line dictionary attack against the user's password. Impact ====== A remote attacker is able to send specially crafted packets to perform a denial of service attack or bypass the requires_preauth flag and obtain ciphertext that could be used to conduct an off-line dictionary attack against the user's password. References ========== https://krbdev.mit.edu/rt/Ticket/Display.html?id=8050 https://krbdev.mit.edu/rt/Ticket/Display.html?id=8160 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5355 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2694 https://bugs.archlinux.org/task/45575

1 0