- Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201409-4] mediawiki: Cross-site Scripting (XSS)
by Levente Polyak 29 Sep '14

29 Sep '14

Arch Linux Security Advisory ASA-201409-4 ========================================= Severity: High Date : 2014-09-29 CVE-ID : CVE-7199 Package : mediawiki Type : Cross-site Scripting (XSS) Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mediawiki before version 1.23.4-1 is vulnerable to Cross-site Scripting (XSS). Resolution ========== Upgrade to 1.23.4-1. # pacman -Syu "mediawiki>=1.23.4-1" The problem has been fixed upstream in version 1.23.4. Workaround ========== None. Description =========== It was discovered that MediaWiki, a wiki engine, did not sufficiently filter CSS in uploaded SVG files, allowing for cross site scripting. Impact ====== A remote attacker is able to upload a crafted SVG file to perform a cross site scripting attack. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7199 https://bugzilla.wikimedia.org/show_bug.cgi?id=69008 https://bugs.archlinux.org/task/42161 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-September/000…

1 0

[arch-security] Arch Linux Security Advisories
by Remi Gacogne 27 Sep '14

27 Sep '14

Hi all, A recent discussion on the #archlinux-security IRC channel led to the proposal of posting security announcements to the arch-security mailing-list every time a vulnerability concerning an Arch Linux package is disclosed, as other distributions are already doing [1][2]. The final goal is to be able to notify Arch users that they may need to quickly upgrade a specific package due to a vulnerability. In order to do so efficiently, I believe we need to think of a way for package maintainers to notify the Arch Linux CVE Monitoring Team (or whoever handling advisories) when they upgrade a package due to a specific security issue (if they are aware of it, of course). This would be complementary to the role of the CVE Monitoring Team, which is to monitor CVE and let package maintainers know when a package need to be upgraded / patched to fix a vulnerability. Based on an idea by Bluewind, I made the following template for advisories, and will be sending an advisory for the recent NSS vulnerability as an example in the next few minutes. Any comment to the idea of security advisories and/or this template are welcome. Best regards, Remi [1] https://lists.debian.org/debian-security-announce/ [2] http://www.gentoo.org/security/en/glsa/index.xml Template: Subject: [Arch Linux Security Advisory <YYYYMM-N>] <Package>: <Vulnerability Type> Body: Arch Linux Security Advisory YYYYMM-N ===================================== Severity: Low, Medium, High, Critical Date : YYYY-MM-DD CVE-ID : <CVE-ID> Package : <package> Type : <Vulnerability Type> Remote : <Yes/No> Link : https://wiki.archlinux.org/index.php/CVE-YYYY Summary ======= The package <package> before version <Arch Linux fixed version> is vulnerable to <Vulnerability type>. Resolution ========== Upgrade to <Arch Linux fixed version>. The problem has been fixed upstream in version <upstream fixed version>. Workaround ========== <Is there a way to mitigate this vulnerability without upgrading?> Description =========== <Long description, for example from original advisory>. Impact ====== < What is it that an attacker can do? Does this need existing pre-conditions to be exploited (valid credentials, physical access)? Is this remotely exploitable? >. References ========== <CVE-Link> <Upstream report> <Arch Linux Bug-Tracker>

5 7

[arch-security] [Arch Linux Security Advisory ASA-201409-3] python2: Information leakage through integer overflow
by Remi Gacogne 26 Sep '14

26 Sep '14

Arch Linux Security Advisory ASA-201409-3 ========================================= Severity: Low Date : 2014-09-26 CVE-ID : CVE-2014-7185 Package : python2 Type : Integer overflow Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package python2 before version 2.7.8-1 is vulnerable to an integer overflow vulnerability. Resolution ========== Upgrade to 2.7.8-1. $ pacman -Syu "python2>=2.7.8-1" The problem has been fixed upstream in version 2.7.8 [1]. Workaround ========== None. Description =========== It was reported that Python 2.7.8 fixes a potential wraparound in buffer() with possible CWE-200 implications. This could allow an attacker to access private information through information leakage. PoC: --- overflow.py --- import sys a = bytearray('here be dragons') b = buffer(a, sys.maxsize, sys.maxsize) print b[:8192] ------------------- References ========== [1] https://www.python.org/downloads/release/python-278/ http://bugs.python.org/issue21831 https://bugzilla.redhat.com/show_bug.cgi?id=1146026

1 0

[arch-security] [Arch Linux Security Advisory 201409-2] bash: Remote code execution
by Remi Gacogne 26 Sep '14

26 Sep '14

Arch Linux Security Advisory 201409-2 ===================================== Severity: Critical Date : 2014-09-26 CVE-ID : CVE-2014-6271, CVE-2014-7169 Package : bash Type : Remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package bash before version 4.3.026-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 4.3.026-1. $ pacman -Syu "bash>=4.3.026-1" The problem has not been fixed upstream yet, though some patches were released [1]. Workaround ========== It is possible to work around this issue by replacing bash with a non-affected shell, for example dash, when specifics bash features are not needed. Description =========== GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. References ========== [1] http://ftp.gnu.org/gnu/bash/bash-4.3-patches/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169 https://bugs.archlinux.org/task/42109 http://lcamtuf.blogspot.fr/2014/09/quick-notes-about-bash-bug-its-impact.ht…

1 0

[arch-security] [Arch Linux Security Advisory 201409-1] NSS: Signature forgery attack
by Remi Gacogne 25 Sep '14

25 Sep '14

Arch Linux Security Advisory 201409-1 ===================================== Severity: High Date : 2014-09-24 CVE-ID : CVE-2014-1568 Package : nss Type : Signature forgery attack Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package nss before version 3.17.1-1 is vulnerable to a signature forgery attack. Resolution ========== Upgrade to 3.17.1-1. The problem has been fixed upstream in version 3.17.1. Description =========== Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Impact ====== This vulnerability may allow an attacker to forge false RSA certificates, considered valid by applications, like Firefox or Thunderbird, that rely on NSS to valid certificates. This could for example be used to conduct Man-In-The-Middle attack. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1568 https://www.mozilla.org/security/announce/2014/mfsa2014-73.html

1 0

[arch-security] CVE-2014-507
by Mark Lee 26 Jul '14

26 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 To All, It has been mentioned on OSS-security that there's a null pointer dereference flaw in the Stream Control Transmission Protocol in the Linux kernel. Currently Arch Linux builds this option as a module. I've already filed a bug report at : <https://bugs.archlinux.org/task/41346> Regards, Mark -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iF4EAREIAAYFAlPTG7MACgkQZ/Z80n6+J/Y0kgEAgNUyMioU8wmch3jTdiDegjVU G2+1JljcQ/TnvnOZFCABAIUehzWBDhpJ2vsX3VSjGQgwRQEpXsJHgfulKNYrjhqT =ziEQ -----END PGP SIGNATURE-----

1 0

[arch-security] net: SCTP: NULL pointer dereference
by Mark Lee 24 Jul '14

24 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 To all, A net SCTP null pointer dereference has been discovered in linux kernel; it can result in a DoS. See bug report :https://bugs.archlinux.org/task/41329 Regards, Mark -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlPROToACgkQZ/Z80n6+J/ZxlQEAjzCaj3I3xDLVLVk1SVdqxfNt taoD1v0i4k0qjv/pLmgA/As2PL2xn5wRlIC0KsD5VTHhNF6NN19WZR4DqRWdxa81 =Pigy -----END PGP SIGNATURE-----

1 0

[arch-security] How to properly report vulnerabilities
by Karol Blazewicz 08 Jul '14

08 Jul '14

Should I open a bug report saying that e.g. some Arch package has certain vulnerability, mark the report as critical and wait for someone to set it as private? How do we deal with such sensitive information? I've looked in the wiki, but neither https://wiki.archlinux.org/index.php/Arch_CVE_Monitoring_Team nor https://wiki.archlinux.org/index.php/CVE-2014 has any info on this.

4 7

[arch-security] DBUS vulnerability in Arch Repo
by Mark Lee 02 Jul '14

02 Jul '14

To all, A recent vulnerability in all 1.3 < dbus < 1.8.6 was reported on oss-security. While I normally only look at kernel bugs, I found this important. See : [fd.o#79694] https://bugs.freedesktop.org/show_bug.cgi?id=79694 [fd.o#80469] https://bugs.freedesktop.org/show_bug.cgi?id=80469 [fd.o#80163] https://bugs.freedesktop.org/show_bug.cgi?id=80163. Regards, Mark

1 0

[arch-security] sctp:sk_ack_backlog wrap-around problem
by Mark Lee 27 Jun '14

27 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Salutations, To all, please see below for cve request on oss-security. Regards, Mark > Description of the problem: > For a TCP-style socket, while processing the COOKIE_ECHO chunk in > sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a > new association would be created in sctp_unpack_cookie(), but > afterwards, some processing maybe failed, and sctp_association_free() > will be called to free the previously allocated association, in > sctp_association_free(), sk_ack_backlog value is decremented for this > socket, since the initial value for sk_ack_backlog is 0, after > the decrement, it will be 65535, a wrap-around problem happens, and > if we want to establish new associations afterward in the same > socket, ABORT would be triggered since sctp deem the accept queue as > full. > > A remote attacker can block further connection to the particular sctp > server socket by sending a specially crafted sctp packet. > > Upstream patch: > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… > > References: > https://bugzilla.redhat.com/show_bug.cgi?id=1113967 > > Thanks, > -- Petr Matousek / Red Hat Product Security PGP: 0xC44977CA 8107 AF16 A416 F9AF 18F3 D874 3E78 6F42 C449 77CA -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlOtv1QACgkQZ/Z80n6+J/aYmwD9GzejDSu/l41OV5dgIes8Xy7C Vr3zSrDFm1/M0Ur+yUUA/RgT1i8XfMefZrxXf8Mz50QyDEZDL94/h3TzNKdntQka =WrWf -----END PGP SIGNATURE-----

1 0