- Arch-security - lists.archlinux.org

[arch-security] [ASA-201504-13] ruby: permissive certificate verification
by Levente Polyak 14 Apr '15

14 Apr '15

Arch Linux Security Advisory ASA-201504-13 ========================================== Severity: Medium Date : 2015-04-14 CVE-ID : CVE-2015-1855 Package : ruby Type : permissive certificate verification Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ruby before version 2.2.2-1 is vulnerable to permissive certificate verification via matching of hostnames. Resolution ========== Upgrade to 2.2.2-1. # pacman -Syu "ruby>=2.2.2-1" The problem has been fixed upstream in version 2.2.2. Workaround ========== None. Description =========== After reviewing RFC 6125 and RFC 5280, multiple violations were found of matching hostnames and particularly wildcard certificates. Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching of more than one wildcard per subject/SAN is no-longer allowed. As well, comparison of these values are now case-insensitive. This change will take affect Ruby’s OpenSSL::SSL#verify_certificate_identity behavior. Specifically: - Only one wildcard character in the left-most part of the hostname is allowed. - IDNA names can now only be matched by a simple wildcard (e.g. ‘*.domain’). - Subject/SAN should be limited to ASCII characters only. Impact ====== A remote attacker can make use of the overly permissive hostname matching during certificate verifications to perform a man-in-the-middle attack by spoofing SSL servers via a crafted certificate. References ========== https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching… https://access.redhat.com/security/cve/CVE-2015-1855 https://bugs.ruby-lang.org/issues/9644

1 0

[arch-security] [ASA-201504-12] icecast: denial of service
by Christian Rebischke 11 Apr '15

11 Apr '15

Arch Linux Security Advisory ASA-201504-12 ========================================= Severity: Medium Date : 2015-04-11 CVE-ID : CVE-2015-3026 Package : icecast Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package icecast before version 2.4.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "icecast>=2.4.2-1" The problem has been fixed upstream in version 2.4.2. Workaround ========== None. Description =========== CVE-2015-3026 (denial of service): The bug can only be triggered if "stream_auth" is being used. This means, that all installations that use a default configuration are NOT affected.The default configuration only uses <source-password>. Neither are simple mountpoints affected that use <password>. A workaround, if installing an updated package is not possible, is to disable "stream_auth"and use <password> instead. As far as we understand the bug only leads to a simple remote denial of service. The underlying issue is a null pointer dereference. For clarity: No remote code execution should be possible, server just segfaults. Impact ====== An attacker could kill, with triggering the server with a special URL, the icecast-server due to a null pointer dereference. References ========== http://seclists.org/oss-sec/2015/q2/78 http://seclists.org/oss-sec/2015/q2/80 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3026 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782120 https://trac.xiph.org/ticket/2191 http://lists.xiph.org/pipermail/icecast-dev/2015-April/002460.html https://trac.xiph.org/changeset/27abfbbd688df3e3077b535997330aa06603250f/ic…

1 0

[arch-security] [ASA-201504-11] mediawiki: multiple issues
by Levente Polyak 09 Apr '15

09 Apr '15

Arch Linux Security Advisory ASA-201504-11 ========================================== Severity: Medium Date : 2015-04-10 CVE-ID : CVE-2015-2931 CVE-2015-2932 CVE-2015-2933 CVE-2015-2934 CVE-2015-2935 CVE-2015-2936 CVE-2015-2937 CVE-2015-2938 CVE-2015-2939 CVE-2015-2940 CVE-2015-2941 CVE-2015-2942 Package : mediawiki Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mediawiki before version 1.24.2-1 is vulnerable to multiple issues including but not limited to cross-side scripting, external resource loading, cross-side request forgery and denial of service. Resolution ========== Upgrade to 1.24.2-1. # pacman -Syu "mediawiki>=1.24.2-1" The problems have been fixed upstream in version 1.24.2. Workaround ========== None. Description =========== - CVE-2015-2931 (cross-side scripting) It was discovered that MIME types were not properly restricted, allowing a way to circumvent the SVG MIME blacklist for embedded resources. This allowed an attacker to embed JavaScript in a SVG file. - CVE-2015-2932 (cross-side scripting) The SVG filter to prevent injecting JavaScript using animate elements was incorrect. The list of dangerous parts of HTML5 is supposed to include all uses of 'animate attributename="xlink:href"' in SVG documents. - CVE-2015-2933 (cross-side scripting) A persistent XSS vulnerability was discovered due to the way attributes were expanded in MediaWiki's HTML class, in combination with LanguageConverter substitutions. - CVE-2015-2934 (cross-side scripting) It was discovered that MediaWiki's SVG filtering could be bypassed with entity encoding under the Zend interpreter. This could be used to inject JavaScript. - CVE-2015-2935 (external resource loading) A way was discovered to bypass the style filtering for SVG files to load external resource. This could violate the anonymity of users viewing the SVG. This issue exists because of an incomplete fix for CVE-2014-7199. - CVE-2015-2936 (denial of service) It was discovered that MediaWiki versions using PBKDF2 for password hashing (the default since 1.24) are vulnerable to DoS attacks using extremely long passwords. - CVE-2015-2937 (denial of service) It was discovered that MediaWiki is vulnerable to "Quadratic Blowup" denial of service attacks. - CVE-2015-2938 (cross-side scripting) It was discovered that the MediaWiki feature allowing a user to preview another user's custom JavaScript could be abused for privilege escalation. This feature has been removed. - CVE-2015-2939 (cross-side scripting) It was discovered that function names were not sanitized in Lua error backtraces, which could lead to XSS. - CVE-2015-2940 (cross-side request forgery) It was discovered that the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users. Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise. - CVE-2015-2941 (cross-side scripting) It was discovered that XSS is possible in the way api errors were reflected under HHVM versions before 3.6.1. MediaWiki now detects and mitigates this issue on older versions of HHVM. - CVE-2015-2942 (denial of service) It was discovered that MediaWiki's SVG and XMP parsing running under HHVM was susceptible to "Billion Laughs" DoS attacks. Impact ====== A remote attacker is able to perform cross-side scripting, external resource loading, cross-side request forgery and denial of service via various vectors. References ========== https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.… http://seclists.org/oss-sec/2015/q2/61 https://access.redhat.com/security/cve/CVE-2015-2931 https://access.redhat.com/security/cve/CVE-2015-2932 https://access.redhat.com/security/cve/CVE-2015-2933 https://access.redhat.com/security/cve/CVE-2015-2934 https://access.redhat.com/security/cve/CVE-2015-2935 https://access.redhat.com/security/cve/CVE-2015-2936 https://access.redhat.com/security/cve/CVE-2015-2937 https://access.redhat.com/security/cve/CVE-2015-2938 https://access.redhat.com/security/cve/CVE-2015-2939 https://access.redhat.com/security/cve/CVE-2015-2940 https://access.redhat.com/security/cve/CVE-2015-2941 https://access.redhat.com/security/cve/CVE-2015-2942

1 0

[arch-security] [ASA-201504-10] libssh2: out-of-bounds read
by Levente Polyak 09 Apr '15

09 Apr '15

Arch Linux Security Advisory ASA-201504-10 ========================================== Severity: Medium Date : 2015-04-09 CVE-ID : CVE-2015-1782 Package : libssh2 Type : out-of-bounds read Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libssh2 before version 1.5.0-1 is vulnerable to out-of-bounds read leading to denial of service and information disclosure. Resolution ========== Upgrade to 1.5.0-1. # pacman -Syu "libssh2>=1.5.0-1" The problem has been fixed upstream in version 1.5.0. Workaround ========== None. Description =========== When negotiating a new SSH session with a remote server, one of libssh2's functions for doing the key exchange (kex_agree_methods()) was naively reading data from the incoming packet and using it without doing sufficient range checks. The SSH_MSG_KEXINIT packet arrives to libssh2 with a set of strings, sent as a series of LENGTH + DATA pairs. libssh2 would go through the list and read the LENGTH field, read the string following the LENGTH and then advance the pointer LENGTH bytes in memory and expect to find the next LENGTH + DATA pair there. Then move on until seven subsequent strings are taken care of. It would naively assume that the (unsigned 32 bit) LENGTH fields were valid. This packet arrives in the negotiating phase so the remote server has not yet been deemed to be a known or trusted party. Impact ====== A remote attacker could man-in-the-middle a real server and cause libssh2 using clients to crash, resulting in denial of service, or otherwise read and use completely unintended memory areas in this process. References ========== http://www.libssh2.org/adv_20150311.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1782 https://bugs.archlinux.org/task/44146

1 0

[arch-security] [ASA-201504-9] chrony: denial of service
by Christian Rebischke 08 Apr '15

08 Apr '15

Arch Linux Security Advisory ASA-201504-9 ========================================= Severity: Medium Date : 2015-04-08 CVE-ID : CVE-2015-1853 Package : chrony Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chrony before version 1.31.1-1 is vulnerable to denial of service Resolution ========== Upgrade to 1.31.1-1 # pacman -Syu "chrony>=1.31.1-1" The problem has been fixed upstream. Workaround ========== None. Description =========== CVE-2015-1853 (denial of service): This issue is similiar to the "ntp CVE-2015-1799"-issue. An attacker knowing that NTP hosts A and B are peering with each other (symmetric association) can send a packet to host A with source address of B which will set the NTP state variables on A to the values sent by the attacker. Host A will then send on its next poll to B a packet with originate timestamp that doesn't match the transmit timestamp of B and the packet will be dropped. If the attacker does this periodically for both hosts, they won't be able to synchronize to each other. This is a known denial-of-service attack Impact ====== CVE-2015-1853 (denial of service): An attacker could stop the synchronizing process of chrony. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1853 https://access.redhat.com/security/cve/CVE-2015-1853 http://seclists.org/oss-sec/2015/q2/63

1 0

[arch-security] revoke of [ASA-201504-9] due to wrong version number
by Christian Rebischke 08 Apr '15

08 Apr '15

Hello Guys, Sorry I did a mistake with the version number of chrony. I will rewrite the ASA and post it again best regards -------------------------------------------------------------- Christian Rebischke Website : www.nullday.de Twitter : @sh1bumi Jabber : shibumi(a)jabber.ccc.de PGP : 0x8D8172C8 Fingerprint: A224 6F57 FD0A AC81 3971 EEBE 5EDA 916B 3A2A 7C49 --------------------------------------------------------------

1 0

[arch-security] [ASA-201504-9] chrony: denial of service
by Christian Rebischke 08 Apr '15

08 Apr '15

Arch Linux Security Advisory ASA-201504-9 ========================================= Severity: Medium Date : 2015-04-08 CVE-ID : CVE-2015-1853 Package : chrony Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chrony before version 1.31-2 is vulnerable to denial of service Resolution ========== Upgrade to 1.31-2. # pacman -Syu "chrony>=1.31-2" The problem has been fixed upstream. Workaround ========== None. Description =========== CVE-2015-1853 (denial of service): This issue is similiar to the "ntp CVE-2015-1799"-issue. An attacker knowing that NTP hosts A and B are peering with each other (symmetric association) can send a packet to host A with source address of B which will set the NTP state variables on A to the values sent by the attacker. Host A will then send on its next poll to B a packet with originate timestamp that doesn't match the transmit timestamp of B and the packet will be dropped. If the attacker does this periodically for both hosts, they won't be able to synchronize to each other. This is a known denial-of-service attack Impact ====== CVE-2015-1853 (denial of service): An attacker could stop the synchronizing process of chrony. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1853 https://access.redhat.com/security/cve/CVE-2015-1853 http://seclists.org/oss-sec/2015/q2/63

1 0

[arch-security] [ASA-201504-8] ntp: multiple issues
by Christian Rebischke 08 Apr '15

08 Apr '15

Arch Linux Security Advisory ASA-201504-8 ========================================= Severity: Medium Date : 2015-04-08 CVE-ID : CVE-2015-1798 CVE-2015-1799 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8p2-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 4.2.8p2-1. # pacman -Syu "ntp>=4.2.8p2-1" The problems have been fixed upstream. Workaround ========== None. Description =========== CVE-2015-1798 (accept unauthenticated packets): When ntpd is configured to use a symmetric key to authenticate a remote NTP server/peer, it checks if the NTP message authentication code (MAC) in received packets is valid, but not if there actually is any MAC included. Packets without a MAC are accepted as if they had a valid MAC. This allows a MITM attacker to send false packets that are accepted by the client/peer without having to know the symmetric key. The attacker needs to know the transmit timestamp of the client to match it in the forged reply and the false reply needs to reach the client before the genuine reply from the server. The attacker doesn't necessarily need to be relaying the packets between the client and the server. CVE-2015-1799 (denial of service): An attacker knowing that NTP hosts A and B are peering with each other (symmetric association) can send a packet to host A with source address of B which will set the NTP state variables on A to the values sent by the attacker. Host A will then send on its next poll to B a packet with originate timestamp that doesn't match the transmit timestamp of B and the packet will be dropped. If the attacker does this periodically for both hosts, they won't be able to synchronize to each other. This is a known denial-of-service attack Impact ====== CVE-2015-1798 (accept unauthenticated packets): A MITM attacker could send false packets. These packets could be being accepte without knowing the symmetric key. CVE-2015-1799 (denial of service): An attacker could stop the synchronizing process of ntp. References ========== http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1798 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1799

1 0

[arch-security] [ASA-201504-7] tor: multiple issues
by chris.rebischke＠gmail.com 07 Apr '15

07 Apr '15

Arch Linux Security Advisory ASA-201504-7 ========================================= Severity: high Date : 2015-04-07 CVE-ID : CVE-2015-2928 CVE-2015-2929 Package : tor Type : multiple issues Remote : yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tor before version 0.2.5.12-1 is vulnerable against multiple issues. Resolution ========== Upgrade to 0.2.5.12-1 # pacman -Syu "tor>=0.2.5.12-1" The problem has been fixed upstream in version 0.2.5.12. Workaround ========== None. Description =========== CVE-2015-2928 "disgleirio" discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible. CVE-2015-2929 "DonnchaC" discovered that Tor clients would crash with an assertion failure upon parsing specially crafted hidden service descriptors. Impact ====== An attacker could crash a Tor client or could make a Tor service inaccessible. References ========== https://trac.torproject.org/projects/tor/ticket/15600 https://trac.torproject.org/projects/tor/ticket/15601 http://seclists.org/oss-sec/2015/q2/56

1 0

[arch-security] [ASA-201504-5] java-batik: xml external entity injection
by Levente Polyak 04 Apr '15

04 Apr '15

Arch Linux Security Advisory ASA-201504-5 ========================================= Severity: Medium Date : 2015-04-04 CVE-ID : CVE-2015-0250 Package : java-batik Type : xml external entity injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package java-batik before version 1.8-1 is vulnerable to xml external entity injection. Resolution ========== Upgrade to 1.8-1. # pacman -Syu "java-batik>=1.8-1" The problem has been fixed upstream in version 1.8. Workaround ========== None. Description =========== Batik offers several classes for SVG to PNG/JPG conversion, which suffer from a XML External Entity Injection due to the evaluation of external entities within the given SVG file. If an application offers the possibility to upload a SVG file an attacker can put in a malicious formed file and retrieve sensitive information such as the content of files of the respective server. The type of file that can be retrieved depends on the user context in which the application is running. Impact ====== A remote attacker is able to use a specially crafted SVG file to read arbitrary files or cause a denial of service. References ========== http://seclists.org/fulldisclosure/2015/Mar/142 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0250 https://bugs.archlinux.org/task/44410

1 0