- Arch-security - lists.archlinux.org

[arch-security] [ASA-201503-2] elfutils: directory traversal
by Levente Polyak 02 Mar '15

02 Mar '15

Arch Linux Security Advisory ASA-201503-2 ========================================= Severity: Medium Date : 2015-03-02 CVE-ID : CVE-2014-9447 Package : elfutils Type : directory traversal Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package elfutils before version 0.161-3 is vulnerable to directory traversal. Resolution ========== Upgrade to 0.161-3. # pacman -Syu "elfutils>=0.161-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program. Impact ====== A remote attacker is able to use a specially crafted archive to write to arbitrary files to the root directory. References ========== http://www.openwall.com/lists/oss-security/2014/12/29/2 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9447 https://bugs.archlinux.org/task/44019

1 0

[arch-security] [ASA-201503-1] putty: information disclosure
by Levente Polyak 02 Mar '15

02 Mar '15

Arch Linux Security Advisory ASA-201503-1 ========================================= Severity: Medium Date : 2015-03-02 CVE-ID : CVE-2015-2157 Package : putty Type : information disclosure Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package putty before version 0.64-1 is vulnerable to information disclosure of SSH-2 private key information. Resolution ========== Upgrade to 0.64-1. # pacman -Syu "putty>=0.64-1" The problem has been fixed upstream in version 0.64. Workaround ========== None. Description =========== When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys. After loading a private key from a disk file, PuTTY mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created. This applies to SSH-2 private keys only. It affects all tools in the PuTTY suite which load or save private keys: PuTTY, Plink, PSCP, PSFTP, Pageant and PuTTYgen. If any of those programs loads a private key directly (rather than getting a signature from an SSH agent such as Pageant) then they will have left information equivalent to the private key in memory for their entire run. Impact ====== A local attacker is able to retrieve SSH-2 private key information from memory after loading and saving key files to disk as a result of inappropriate wipe. References ========== http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2157

1 0

[arch-security] [ASA-201503-1] krb5: information disclosure
by Levente Polyak 02 Mar '15

02 Mar '15

Arch Linux Security Advisory ASA-201503-1 ========================================= Severity: Medium Date : 2015-03-02 CVE-ID : CVE-2015-2157 Package : putty Type : information disclosure Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package putty before version 0.64-1 is vulnerable to information disclosure of SSH-2 private key information. Resolution ========== Upgrade to 0.64-1. # pacman -Syu "putty>=0.64-1" The problem has been fixed upstream in version 0.64. Workaround ========== None. Description =========== When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys. After loading a private key from a disk file, PuTTY mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created. This applies to SSH-2 private keys only. It affects all tools in the PuTTY suite which load or save private keys: PuTTY, Plink, PSCP, PSFTP, Pageant and PuTTYgen. If any of those programs loads a private key directly (rather than getting a signature from an SSH agent such as Pageant) then they will have left information equivalent to the private key in memory for their entire run. Impact ====== A local attacker is able to retrieve SSH-2 private key information from memory after loading and saving key files to disk as a result of inappropriate wipe. References ========== http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2157

1 1

[arch-security] [ASA-201502-15] thunderbird: multiple issues
by Remi Gacogne 25 Feb '15

25 Feb '15

Arch Linux Security Advisory ASA-201502-15 ========================================== Severity: High Date : 2015-02-25 CVE-ID : CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0835 CVE-2015-0836 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 31.5.0-1 is vulnerable to multiple issues including information leak and remote code execution when used as a web browser. Resolution ========== Upgrade to 31.5.0-1. # pacman -Syu "thunderbird>=31.5.0-1" The problem has been fixed upstream in version 31.5.0. Workaround ========== In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts. Description =========== - CVE-2015-0822 (information leak): Security researcher Armin Razmdjou reported that a user readable file in a known local path could be uploaded to a malicious site. This was done by manipulating the autocomplete feature in a form and user interaction with it. While the local file is not visibly uploaded through the form, its contents are made available through the Document Object Model (DOM) to script content on the attacking page, leading to information disclosure. - CVE-2015-0827 (out-of-bounds read and write, possibly leading to remote code execution) Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to report an out-of-bounds read and an out-of-bounds write when rendering an improperly formatted SVG graphic. This could potentially allow the attacker to read uninitialized memory. - CVE-2015-0831 (use-after-free, possibily leading to remote code execution) Security researcher Paul Bandha used the used the Address Sanitizer tool to discover a use-after-free vulnerability when running specific web content with IndexedDB to create an index. This leads to a potentially exploitable crash. - CVE-2015-0835, CVE-2015-0836 (remote code execution): Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Impact ====== A remote attacker may be able to access sensitive information or execute arbitrary code References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0822 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0827 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0831 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0835 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0836

1 0

[arch-security] [ASA-201502-14] firefox: multiple issues
by Remi Gacogne 25 Feb '15

25 Feb '15

Arch Linux Security Advisory ASA-201502-14 ========================================== Severity: Critical Date : 2015-02-25 CVE-ID : CVE-2015-0819 CVE-2015-0821 CVE-2015-0822 CVE-2015-0823 CVE-2015-0824 CVE-2015-0825 CVE-2015-0826 CVE-2015-0827 CVE-2015-0829 CVE-2015-0830 CVE-2015-0831 CVE-2015-0832 CVE-2015-0834 CVE-2015-0835 CVE-2015-0836 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 36.0-1 is vulnerable to multiple issues, including denial of service, information leak and remote code execution. Resolution ========== Upgrade to 36.0-1. # pacman -Syu "firefox>=36.0-1" The problem has been fixed upstream in version 36.0. Workaround ========== None. Description =========== - CVE-2015-0819 (tab spoofing): Mozilla developer Matthew Noorenberghe reported that whitelisted Mozilla domains could make UITour API calls while the UI Tour pages for Firefox are present in background tabs. If one of these Mozilla domains was compromised and open in another tab, an attacker could then use that tab to engage in spoofing and clickjacking in any foreground tab. - CVE-2015-0821: Security researcher Armin Razmdjou reported that opening hyperlinks on a page with the mouse and specific keyboard key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. This could also allow for the opening of local files or resources from a known location to be opened with local privileges, bypassing security protections. - CVE-2015-0822 (information leak): Security researcher Armin Razmdjou reported that a user readable file in a known local path could be uploaded to a malicious site. This was done by manipulating the autocomplete feature in a form and user interaction with it. While the local file is not visibly uploaded through the form, its contents are made available through the Document Object Model (DOM) to script content on the attacking page, leading to information disclosure. - CVE-2015-0823 (use-after-free): Using the Address Sanitizer tool, security researcher Atte Kettunen found a problem with OpenType Sanitiser (OTS) that resulted in a use-after-free while expanding macros in some circumstances. This use-after-free was only used for information displayed in the developer console and was not exploitable. - CVE-2015-0824 (denial of service): Security researcher Atte Kettunen used the Address Sanitizer tool to discover a crash while drawing images through the Cairo graphics library while using the DrawTarget function. This can result in a segmentation fault due to zero-ing out of memory outside the bounds of the image. - CVE-2015-0825 (information leak): Security researcher Atte Kettunen used the Address Sanitizer tool to discover a buffer underflow during audio playback of a badly formatted MP3 audio files. Through memory allocation manipulation it may be possible to incorporate parts of Firefox memory into an MP3 stream accessible to scripts on the page. - CVE-2015-0826 (out-of-bounds read possibly leading to remote code execution): Security researcher Atte Kettunen used the Address Sanitizer tool to discover an out-of-bounds read during the application of restyling and reflowing changes of web content using CSS. This results in a potentially exploitable crash. - CVE-2015-0827 (out-of-bounds read and write, possibly leading to remote code execution) Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to report an out-of-bounds read and an out-of-bounds write when rendering an improperly formatted SVG graphic. This could potentially allow the attacker to read uninitialized memory. - CVE-2015-0829 (buffer overflow possibily leading to remote code execution) Security researcher Pantrombka reported a buffer overflow in the libstagefright library during video playback when certain invalid MP4 video files led to the allocation of a buffer that was too small for the content. This led to a potentially exploitable crash. - CVE-2015-0830 (denial of service) Security researcher Daniele Di Proietto discovered that when WebGL content crafted in a specific manner wrote strings, it would cause a crash when this content was run. - CVE-2015-0831 (use-after-free, possibily leading to remote code execution) Security researcher Paul Bandha used the used the Address Sanitizer tool to discover a use-after-free vulnerability when running specific web content with IndexedDB to create an index. This leads to a potentially exploitable crash. - CVE-2015-0832 (HPKP and HSTS bypass): Security researcher Muneaki Nishimura reported that when certificate pinning is set to "strict" mode, a period ('.') appended to a hostname in the address of a site allowed the bypass key pinning (HPKP) and HTTP Strict Transport Security (HSTS). Sites with a period appended were treated as having a different origin than sites without the period. If an attacker had a security certificate for a domain with the added period, this would allow for a Man-in-the-middle (MITM) attack on users. - CVE-2015-0834 (information leak): Security researcher Alexander Kolesnik reported while the Mozilla platform does not yet support TLS connections to TURN and STUN servers, the WebRTC implementation would accept turns: and stuns: URIs and then attempt plaintext connections to the servers when these were used. This can lead to disclosure of credentials through a Man-in-the-middle (MITM) attack as the connection is not encrypted. - CVE-2015-0835, CVE-2015-0836 (remote code execution): Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Impact ====== A remote attacker may be able to access sensitive information from the memory or from files stored locally, crash the browser or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0819 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0821 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0822 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0823 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0824 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0825 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0826 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0827 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0829 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0830 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0831 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0832 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0834 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0835 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0836

1 0

[arch-security] [ASA-201502-13] samba: arbitrary code execution
by Levente Polyak 23 Feb '15

23 Feb '15

Arch Linux Security Advisory ASA-201502-13 ========================================== Severity: High Date : 2015-02-23 CVE-ID : CVE-2015-0240 Package : samba Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package samba before version 4.1.17-1 is vulnerable to arbitrary code execution with root privileges. Resolution ========== Upgrade to 4.1.17-1. # pacman -Syu "samba>=4.1.17-1" The problem has been fixed upstream in version 4.1.17. Workaround ========== To mitigate the possibility of exploitation before you can perform a full update, add the following line to the [global] section of the /etc/samba/smb.conf configuration file: rpc_server:netlogon=disabled For the configuration change to take effect, the smbd daemon must be restarted. Description =========== A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges. This flaw arises because of an uninitialized pointer is passed to the TALLOC_FREE() function. (Samba uses embedded talloc for memory management and does not rely on the glibc malloc family to function). It can be exploited by calling the ServerPasswordSet RPC api on the NetLogon endpoint, by using a NULL session over IPC. In Samba 4.1 and above, this crash can only be triggered after setting “server schannel = yes” in the server configuration. This is due to the adbe6cba005a2060b0f641e91b500574f4637a36 commit, which introduces NULL initialization into the most common code path. It is still possible to trigger an early return with a memory allocation failure, but that is less likely to occur. Impact ====== A remote unauthenticated attacker is able to send specially crafted packets to execute arbitrary code with root privileges. References ========== https://www.samba.org/samba/history/samba-4.1.17.html https://access.redhat.com/security/cve/CVE-2015-0240 https://bugs.archlinux.org/task/43923

1 0

[arch-security] [ASA-201502-12] krb5: multiple issues
by Remi Gacogne 17 Feb '15

17 Feb '15

Arch Linux Security Advisory ASA-201502-12 ========================================== Severity: High Date : 2015-02-17 CVE-ID : CVE-2014-5352 CVE-2014-5353 CVE-2014-5354 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 Package : krb5 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package krb5 before version 1.13.1-1 is vulnerable to multiple issues including authenticated remote code execution, authenticated remote denial of service, authenticated remote privilege escalation and remote information leak. Resolution ========== Upgrade to 1.13.1-1. # pacman -Syu "krb5>=1.13.1-1" The problem has been fixed upstream in version 1.13.1. Workaround ========== None. Description =========== - CVE-2014-5352 (authenticated remote code execution): In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind are vulnerable as they can be instructed to call gss_process_context_token(). - CVE-2014-5353 (authenticated remote denial of service): In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause a NULL dereference by attempting to use a named ticket policy object as a password policy for a principal. The attacker needs to be authenticated as a user who has the elevated privilege for setting password policy by adding or modifying principals. - CVE-2014-5354 (authenticated remote denial of service): In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause a NULL dereference by inserting into the database a principal entry which contains no long-term keys. - CVE-2014-9421 (authenticated remote code execution): If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may perform use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications may also be vulnerable if they contain insufficiently defensive XDR functions. - CVE-2014-9422 (privilege escalation): The MIT krb5 kadmind daemon incorrectly accepts authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm. - CVE-2014-9423 (unauthenticated remote information leak): libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients. Impact ====== A remote, unauthenticated attacker can retrieve sensitive information from the memory of the affected system. A remote authenticated attacker can crash the affected process, escalate to administrative privileges and execute arbitrary code. References ========== http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt https://access.redhat.com/security/cve/CVE-2014-5352 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5353 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5354 https://access.redhat.com/security/cve/CVE-2014-9421 https://access.redhat.com/security/cve/CVE-2014-9422 https://access.redhat.com/security/cve/CVE-2014-9423 http://www.openwall.com/lists/oss-security/2014/12/16/1

1 0

[arch-security] [ASA-201502-11] xorg-server: information leak and denial of service
by Levente Polyak 11 Feb '15

11 Feb '15

Arch Linux Security Advisory ASA-201502-11 ========================================== Severity: Medium Date : 2015-02-10 CVE-ID : CVE-2015-0245 Package : xorg-server Type : information leak, denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package xorg-server before version 1.16.4-1 is vulnerable to information leak and denial of service. Resolution ========== Upgrade to 1.16.4-1. # pacman -Syu "xorg-server>=1.16.4-1" The problem has been fixed upstream in version 1.16.4. Workaround ========== None. Description =========== Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request. The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. The data length is at least up to 64k, it is possible to obtain more data by chaining strings, each string length is then determined by whatever happens to be in that 16-bit region of memory. A similarly crafted request can likely cause the X server to crash. Impact ====== A remote attacker is able to use specially crafted XkbSetGeometry requests to obtain adjacent memory data into the XKB structs leading to information leakage or cause the X server to crash resulting in denial of service. References ========== http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/ http://cgit.freedesktop.org/xorg/xserver/commit/?id=20079c https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0255

1 0

[arch-security] [ASA-201502-10] dbus: denial of service
by Levente Polyak 10 Feb '15

10 Feb '15

Arch Linux Security Advisory ASA-201502-10 ========================================== Severity: Medium Date : 2015-02-10 CVE-ID : CVE-2015-0245 Package : dbus Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package dbus before version 1.8.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.8.16-1. # pacman -Syu "dbus>=1.8.16-1" The problem has been fixed upstream in version 1.8.16. Workaround ========== None. Description =========== Systemd sends back an ActivationFailure D-Bus signal if the activation fails. However, when it receives these signals, dbus-daemon does not verify that the signal actually came from systemd. A malicious local user could send repeated ActivationFailure signals in the hope that it would "win the race" with the genuine signal, causing D-Bus to send back an error to the client that requested activation. Impact ====== A local attacker could send repeated ActivationFailure signals, causing D-Bus to potentially send back an error to the client that requested activation resulting in denial of service. References ========== http://lists.freedesktop.org/archives/dbus/2015-February/016553.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0245

1 0

[arch-security] [ASA-201502-9] pigz: arbitrary write to files
by Christian Rebischke 09 Feb '15

09 Feb '15

Arch Linux Security Advisory ASA-201502-9 ========================================= Severity: High Date : 2015-02-09 CVE-ID : CVE-2015-1191 Package : pigz Type : arbitrary write to files Remote : yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pigz before version 2.3.3-1 is vulnerable to multiple directory traversal vulnerabilities. That allows remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive. Resolution ========== Upgrade to 2.3.3-1 # pacman -Syu "pigz>=2.3.3-1" The problem has been fixed upstream in version 2.3.3. Workaround ========== None. Description =========== The package pigz before version 2.3.3-1 is vulnerable to multiple directory traversal vulnerabilities. That allows remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive. Impact ====== A remote attacker is able to write files remotely. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1191

1 0