- Arch-security - lists.archlinux.org

[arch-security] [ASA-201506-5] flashplugin: remote code execution
by Remi Gacogne 24 Jun '15

24 Jun '15

Arch Linux Security Advisory ASA-201506-5 ========================================= Severity: Critical Date : 2015-06-24 CVE-ID : CVE-2015-3113 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.468-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 11.2.202.468-1. # pacman -Syu "flashplugin>=11.2.202.468-1" The problem has been fixed upstream in version 11.2.202.468. Workaround ========== This issue can be mitigated by disabling the flash plugin. Description =========== A heap-based buffer overflow has been found in the FLV handling of Adobe Flash Player, leading to code execution. Impact ====== A remote attacker may be able to execute arbitrary code on a vulnerable host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-14.html https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3113

1 0

[arch-security] [ASA-201506-4] curl: information leakage
by Remi Gacogne 22 Jun '15

22 Jun '15

Arch Linux Security Advisory ASA-201506-4 ========================================= Severity: Medium Date : 2015-06-22 CVE-ID : CVE-2015-3236 CVE-2015-3237 Package : curl Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.43.0-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.43.0-1. # pacman -Syu "curl>=7.43.0-1" The problem has been fixed upstream in version 7.43.0. Workaround ========== None. Description =========== - CVE-2015-3236 (lingering HTTP credentials in connection re-use): libcurl can wrongly send HTTP credentials when re-using connections. libcurl allows applications to set credentials for the upcoming transfer with HTTP Basic authentication, like with CURLOPT_USERPWD for example. Name and password. Just like all other libcurl options the credentials are sticky and are kept associated with the "handle" until something is made to change the situation. Further, libcurl offers a curl_easy_reset() function that resets a handle back to its pristine state in terms of all settable options. A reset is of course also supposed to clear the credentials. A reset is typically used to clear up the handle and prepare it for a new, possibly unrelated, transfer. Within such a handle, libcurl can also store a set of previous connections in case a second transfer is requested to a host name for which an existing connection is already kept alive. With this flaw present, using the handle even after a reset would make libcurl accidentally use those credentials in a subsequent request if done to the same host name and connection as was previously accessed. An example case would be first requesting a password protected resource from one section of a web site, and then do a second request of a public resource from a completely different part of the site without authentication. This flaw would then inadvertently leak the credentials in the second request. - CVE-2015-3237 (SMB send off unrelated memory contents): libcurl can get tricked by a malicious SMB server to send off data it did not intend to. In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back. The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handcrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the values cause libcurl to access invalid memory. Impact ====== A passive remote adversary or a malicious HTTP server may be able to gather sensitive HTTP credentials. A malicious SMB server may be able to extract arbitrary memory content from a vulnerable SMB client using libcurl. References ========== http://curl.haxx.se/docs/adv_20150617A.html http://curl.haxx.se/docs/adv_20150617B.html https://access.redhat.com/security/cve/CVE-2015-3236 https://access.redhat.com/security/cve/CVE-2015-3237

1 0

[arch-security] [ASA-201506-3] openssl: multiple issues
by Levente Polyak 12 Jun '15

12 Jun '15

Arch Linux Security Advisory ASA-201506-3 ========================================= Severity: High Date : 2015-06-12 CVE-ID : CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-4000 Package : openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.b-1 is vulnerable to multiple issues including but not limited to man-in-the-middle via cipher downgrade, double free and denial of service. Resolution ========== Upgrade to 1.0.2.b-1. # pacman -Syu "openssl>=1.0.2.b-1" The problems have been fixed upstream in version 1.0.2.b. Workaround ========== None. Description =========== - CVE-2015-1788 (denial of service) When processing an ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service against any system which processes public keys, certificate requests or certificates. This includes TLS clients and TLS servers with client authentication enabled. - CVE-2015-1789 (out-of-bounds read) X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds. In addition, X509_cmp_time accepts an arbitrary number of fractional seconds in the time string. An attacker can use this to craft malformed certificates and CRLs of various sizes and potentially cause a segmentation fault, resulting in a DoS on applications that verify certificates or CRLs. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks. - CVE-2015-1790 (denial of service) The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected. - CVE-2015-1791 (double free) If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data. - CVE-2015-1792 (denial of service) When verifying a signedData message the CMS code can enter an infinite loop if presented with an unknown hash function OID. This can be used to perform denial of service against any system which verifies signedData messages using the CMS code. - CVE-2015-4000 (cipher downgrade) A vulnerability in the TLS protocol allows a man-in-the-middle attacker to downgrade vulnerable TLS connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. This vulnerability is known as Logjam. OpenSSL has added protection for TLS clients by rejecting handshakes with DH parameters shorter than 768 bits. This limit will be increased to 1024 bits in a future release. Impact ====== A remote attacker is able to perform man-in-the-middle via cipher downgrade, denial of service or possibly have other unspecified impact via various vectors. References ========== https://www.openssl.org/news/secadv_20150611.txt https://access.redhat.com/security/cve/CVE-2015-1788 https://access.redhat.com/security/cve/CVE-2015-1789 https://access.redhat.com/security/cve/CVE-2015-1790 https://access.redhat.com/security/cve/CVE-2015-1791 https://access.redhat.com/security/cve/CVE-2015-1792 https://access.redhat.com/security/cve/CVE-2015-4000

1 0

[arch-security] [ASA-201506-2] cups: multiple issues
by Levente Polyak 10 Jun '15

10 Jun '15

Arch Linux Security Advisory ASA-201506-2 ========================================= Severity: Critical Date : 2015-06-10 CVE-ID : CVE-2015-1158 CVE-2015-1159 Package : cups Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package cups before version 2.0.3-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation and cross-side scripting. Resolution ========== Upgrade to 2.0.3-1. # pacman -Syu "cups>=2.0.3-1" The problems have been fixed upstream in version 2.0.3. Workaround ========== None. Description =========== - CVE-2015-1158 (arbitrary code execution, privilege escalation) An issue with how localized strings are handled in cupsd allows a reference counter to over-decrement when handling certain print job request errors. As a result, an attacker can prematurely free an arbitrary string of global scope, creating a dangling pointer to a repurposed block of memory on the heap. The dangling pointer causes ACL verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL handling failure results in unrestricted access to privileged operations, allowing an unauthenticated remote user to upload a replacement CUPS configuration file and mount further attacks. - CVE-2015-1159 (cross-side scripting) A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. In certain cases, the CGI template can echo user input to file rather than escaping the text first. This may be used to set up a reflected XSS attack in the QUERY parameter of the web interface help page. By default, many linux distributions run with the web interface activated. Impact ====== A remote attacker is able to use a cross-side scripting flaw in order to send a malicious print request that is leading to arbitrary code execution and privilege escalation. References ========== https://www.cups.org/str.php?L4609 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159 https://bugs.archlinux.org/task/45279

1 0

[arch-security] [ASA-201506-1] pcre: buffer overflow
by Remi Gacogne 05 Jun '15

05 Jun '15

Arch Linux Security Advisory ASA-201506-1 ========================================= Severity: High Date : 2015-06-05 CVE-ID : CVE-2015-3210 Package : pcre Type : buffer overflow Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.37-2 is vulnerable to multiple buffer overflows leading to code execution. Resolution ========== Upgrade to 8.37-2. # pacman -Syu "pcre>=8.37-2" The problem has been fixed upstream in the trunk, but no fixed version has been released yet. Workaround ========== None. Description =========== Several buffer overflows have been found in pcre <= 8.37. By compiling a crafted regular expression, it is possible to write more than the expected size into various buffers, allowing arbitrary code execution. Impact ====== An attacker with the ability to submit an arbitrary regular expression for compilation can execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2015-3210 https://bugs.archlinux.org/task/45207 https://bugs.exim.org/show_bug.cgi?id=1636 http://www.securitytracker.com/id/1032453

1 0

[arch-security] [ASA-201505-20] curl: information leakage
by Remi Gacogne 28 May '15

28 May '15

Arch Linux Security Advisory ASA-201505-20 ========================================== Severity: Low Date : 2015-05-28 CVE-ID : CVE-2015-3153 Package : curl Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.42.1-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.42.1-1. # pacman -Syu "curl>=7.42.1-1" The problem has been fixed upstream in version 7.42.1. Workaround ========== This issue can be mitigated when using curl >= 7.37.0: - in libcurl, by setting CURLOPT_HEADEROPT to CURLHEADER_SEPARATE ; - in command-line, by using --proxy-header. Description =========== libcurl provides applications a way to set custom HTTP headers to be sent to the server by using CURLOPT_HTTPHEADER. A similar option is available for the curl command-line tool with the '--header' option. When the connection passes through an HTTP proxy the same set of headers is sent to the proxy as well by default. While this is by design, it has not necessarily been clear nor understood by application programmers. Such tunneling over a proxy is done for example when using the HTTPS protocol - or when explicitly asked for. In this case, the initial connection to the proxy is made in clear including any custom headers using the HTTP CONNECT method. While libcurl provides the CURLOPT_HEADEROPT option to allow applications to tell libcurl if the headers should be sent to host and the proxy or use separate lists to the different destinations, it has still defaulted to sending the same headers to both parties for the sake of compatibility. If the application sets a custom HTTP header with sensitive content (e.g., authentication cookies) without changing the default, the proxy, and anyone who listens to the traffic between the application and the proxy, might get access to those values. Note: this problem doesn't exist when using the CURLOPT_COOKIE option (or the '--cookie' option) or the HTTP auth options, which are always sent only to the destination server. Impact ====== An adversary controlling the HTTP proxy used by client using curl (or libcurl), or listening to the traffic between the application and the proxy, can access to potentially sensitive information contained in HTTP headers. References ========== http://curl.haxx.se/docs/adv_20150429.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3153

1 0

[arch-security] [ASA-201505-19] webkitgtk2: man-in-the-middle
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-19 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-2330 Package : webkitgtk2 Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package webkitgtk2 before version 2.4.9-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 2.4.9-1. # pacman -Syu "webkitgtk2>=2.4.9-1" The problem has been fixed upstream in version 2.4.9. Workaround ========== None. Description =========== It was found that WebKitGTK+ version performed TLS certificate verification too late, after sending an HTTP request rather than before. This issue allows a man-in-the-middle attack to possibly gain sensitive information. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via a crafted TLS certificate to obtain sensitive information. References ========== http://www.openwall.com/lists/oss-security/2015/03/18/4 https://access.redhat.com/security/cve/CVE-2015-2330 https://bugs.archlinux.org/task/44237

1 0

[arch-security] [ASA-201505-18] webkitgtk: man-in-the-middle
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-18 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-2330 Package : webkitgtk Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package webkitgtk before version 2.4.9-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 2.4.9-1. # pacman -Syu "webkitgtk>=2.4.9-1" The problem has been fixed upstream in version 2.4.9. Workaround ========== None. Description =========== It was found that WebKitGTK+ version performed TLS certificate verification too late, after sending an HTTP request rather than before. This issue allows a man-in-the-middle attack to possibly gain sensitive information. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via a crafted TLS certificate to obtain sensitive information. References ========== http://www.openwall.com/lists/oss-security/2015/03/18/4 https://access.redhat.com/security/cve/CVE-2015-2330 https://bugs.archlinux.org/task/44237

1 0

[arch-security] [ASA-201505-17] postgresql: multiple issues
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-17 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-3165 CVE-2015-3166 CVE-2015-3167 Package : postgresql Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package postgresql before version 9.4.2-1 is vulnerable to denial of service, information disclosure and possibly key exposure via a side-channel attack. Resolution ========== Upgrade to 9.4.2-1. # pacman -Syu "postgresql>=9.4.2-1" The problems have been fixed upstream in version 9.4.2. Workaround ========== None. Description =========== - CVE-2015-3165 (denial of service) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash via a double-free issue leading to denial of service. - CVE-2015-3166 (information disclosure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information disclosure. - CVE-2015-3167 (side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message. Impact ====== A remote attacker is able to perform denial of service, disclose sensitive information or possibly expose a cryptographic key via a side-channel attack. References ========== http://www.postgresql.org/about/news/1587/ https://access.redhat.com/security/cve/CVE-2015-3165 https://access.redhat.com/security/cve/CVE-2015-3166 https://access.redhat.com/security/cve/CVE-2015-3167

1 0

[arch-security] [ASA-201505-16] pgbouncer: denial of service
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-16 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-4054 Package : pgbouncer Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pgbouncer before version 1.5.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.5.5-1. # pacman -Syu "pgbouncer>=1.5.5-1" The problem has been fixed upstream in version 1.5.5. Workaround ========== None. Description =========== A remote denial of service vulnerability in check_client_passwd() has been discovered. The issue is triggered if a password packet appears before the startup packet. In such case a null pointer is dereferenced that is leading to application crash. Impact ====== A remote attacker is able to send specially crafted packets that is leading to application crash resulting in denial of service. References ========== http://www.openwall.com/lists/oss-security/2015/05/21/2 https://access.redhat.com/security/cve/CVE-2015-4054 https://github.com/pgbouncer/pgbouncer/issues/42

1 0