- Arch-security - lists.archlinux.org

[ASA-202012-12] blueman: privilege escalation
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-12 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-15238 Package : blueman Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1259 Summary ======= The package blueman before version 2.1.4-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.1.4-1. # pacman -Syu "blueman>=2.1.4-1" The problem has been fixed upstream in version 2.1.4. Workaround ========== As Polkit-1-support is enabled in Arch, it is possible to limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules. Description =========== In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. That is limited to users in the wheel group in the shipped rules file that do have the privileges anyway. On systems with ISC DHCP client (dhclient), attackers can pass arguments to `ip link` with the interface name that can e.g. be used to bring down an interface or add an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Patches are included in 2.1.4 and master that change the DhcpClient D-Bus method(s) to accept BlueZ network object paths instead of network interface names. A backport to 2.0(.8) is also available. As a workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules. Impact ====== A local attacker might be able to escalate privileges. References ========== https://bugs.archlinux.org/task/68563 https://github.com/blueman-project/blueman/security/advisories/GHSA-jpc9-mg… https://bugs.launchpad.net/ubuntu/+source/blueman/+bug/1897287 https://security.archlinux.org/CVE-2020-15238

1 0

[ASA-202012-11] libproxy-mozjs: denial of service
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-11 ========================================== Severity: Low Date : 2020-12-05 CVE-ID : CVE-2020-25219 Package : libproxy-mozjs Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1226 Summary ======= The package libproxy-mozjs before version 0.4.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.16-1. # pacman -Syu "libproxy-mozjs>=0.4.16-1" The problem has been fixed upstream in version 0.4.16. Workaround ========== None. Description =========== url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP PAC server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion. Impact ====== A remote HTTP PAC server might be able to crash an application via a crafted response. References ========== https://github.com/libproxy/libproxy/issues/134 https://github.com/libproxy/libproxy/pull/136 https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e1… https://security.archlinux.org/CVE-2020-25219

1 0

[ASA-202012-10] libproxy: denial of service
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-10 ========================================== Severity: Low Date : 2020-12-05 CVE-ID : CVE-2020-25219 Package : libproxy Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1226 Summary ======= The package libproxy before version 0.4.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.16-1. # pacman -Syu "libproxy>=0.4.16-1" The problem has been fixed upstream in version 0.4.16. Workaround ========== None. Description =========== url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP PAC server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion. Impact ====== A remote HTTP PAC server might be able to crash an application via a crafted response. References ========== https://github.com/libproxy/libproxy/issues/134 https://github.com/libproxy/libproxy/pull/136 https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e1… https://security.archlinux.org/CVE-2020-25219

1 0

[ASA-202012-9] libproxy-webkit: denial of service
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-9 ========================================= Severity: Low Date : 2020-12-05 CVE-ID : CVE-2020-25219 Package : libproxy-webkit Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1226 Summary ======= The package libproxy-webkit before version 0.4.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.16-1. # pacman -Syu "libproxy-webkit>=0.4.16-1" The problem has been fixed upstream in version 0.4.16. Workaround ========== None. Description =========== url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP PAC server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion. Impact ====== A remote HTTP PAC server might be able to crash an application via a crafted response. References ========== https://github.com/libproxy/libproxy/issues/134 https://github.com/libproxy/libproxy/pull/136 https://github.com/libproxy/libproxy/commit/a83dae404feac517695c23ff43ce1e1… https://security.archlinux.org/CVE-2020-25219

1 0

[ASA-202012-8] containerd: privilege escalation
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-8 ========================================= Severity: High Date : 2020-12-05 CVE-ID : CVE-2020-15257 Package : containerd Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1309 Summary ======= The package containerd before version 1.4.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.4.3-1. # pacman -Syu "containerd>=1.4.3-1" The problem has been fixed upstream in version 1.4.3. Workaround ========== If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container. Description =========== In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim's API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. Impact ====== A local attacker might be able to escalate privileges via a malicious container running in the same network namespace as the shim. References ========== https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78… https://github.com/containerd/containerd/commit/428f10fd27eb1f9bd0b9aaa33a6… https://github.com/containerd/containerd/commit/ae3a64aa10d6d9b1567adce0577… https://security.archlinux.org/CVE-2020-15257

1 0

[ASA-202012-7] libslirp: information disclosure
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-7 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-29129 CVE-2020-29130 Package : libslirp Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1305 Summary ======= The package libslirp before version 4.4.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.4.0-1. # pacman -Syu "libslirp>=4.4.0-1" The problems have been fixed upstream in version 4.4.0. Workaround ========== None. Description =========== - CVE-2020-29129 (information disclosure) ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. A privileged guest user may use this flaw to potentially leak host information bytes. - CVE-2020-29130 (information disclosure) slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. A privileged guest user may use this flaw to potentially leak host information bytes. Impact ====== A privileged guest user may be able to access sensitive information from the host memory. References ========== https://www.openwall.com/lists/oss-security/2020/11/27/1 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2e1dcbc0c2af64fcb170… https://git.qemu.org/?p=qemu.git;a=commitdiff;h=37c0c885d19a4c2d69faed891b5… https://security.archlinux.org/CVE-2020-29129 https://security.archlinux.org/CVE-2020-29130

1 0

[ASA-202012-6] xorg-server: arbitrary code execution
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-6 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-14360 CVE-2020-25712 Package : xorg-server Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1310 Summary ======= The package xorg-server before version 1.20.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.20.10-1. # pacman -Syu "xorg-server>=1.20.10-1" The problems have been fixed upstream in version 1.20.10. Workaround ========== None. Description =========== - CVE-2020-14360 (arbitrary code execution) A security issue was discovered in xorg-server before 1.20.10. Insufficient checks on the lengths of the XkbSetMap request can lead to out of bounds memory accesses in the X server. This issue can lead to privilege escalation for authorized clients on systems where the X server is running privileged. - CVE-2020-25712 (arbitrary code execution) A security issue was discovered in xorg-server before 1.20.10. Insufficient checks on input of the XkbSetDeviceInfo request can lead to a buffer overflow on the head in the X server. This issue can lead to privilege escalation for authorized clients on systems where the X server is running privileged. Impact ====== A local attacker might be able to escalate privileges. References ========== https://www.openwall.com/lists/oss-security/2020/12/01/3 https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa7… https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361… https://security.archlinux.org/CVE-2020-14360 https://security.archlinux.org/CVE-2020-25712

1 0

[ASA-202012-3] tomcat9: information disclosure
by Remi Gacogne 09 Dec '20

09 Dec '20

rch Linux Security Advisory ASA-202012-3 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-17527 Package : tomcat9 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1317 Summary ======= The package tomcat9 before version 9.0.40-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 9.0.40-1. # pacman -Syu "tomcat9>=9.0.40-1" The problem has been fixed upstream in version 9.0.40. Workaround ========== None. Description =========== It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. Impact ====== A remote attacker might be able to access sensitive information via well-timed HTTP/2 requests. References ========== https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60 https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b18… https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db… https://security.archlinux.org/CVE-2020-17527

1 1

[ASA-202012-5] ant: arbitrary code execution
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-5 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-11979 Package : ant Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1312 Summary ======= The package ant before version 1.10.9-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.10.9-1. # pacman -Syu "ant>=1.10.9-1" The problem has been fixed upstream in version 1.10.9. Workaround ========== The issue can be mitigated by making Ant use a directory that is only readable and writable by the current user. Description =========== As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process. Impact ====== A local attacker might be able to execute arbitrary code by injecting modified source files into the build process at the exact right moment. References ========== https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920ed… https://security.archlinux.org/CVE-2020-11979

1 0

[ASA-202012-4] tomcat8: information disclosure
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-4 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-17527 Package : tomcat8 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1316 Summary ======= The package tomcat8 before version 8.5.60-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 8.5.60-1. # pacman -Syu "tomcat8>=8.5.60-1" The problem has been fixed upstream in version 8.5.60. Workaround ========== None. Description =========== It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. Impact ====== A remote attacker might be able to access sensitive information via well-timed HTTP/2 requests. References ========== https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60 https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b18… https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40 https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db… https://security.archlinux.org/CVE-2020-17527

1 0