- Arch-security - lists.archlinux.org

[ASA-201803-18] lib32-libcurl-compat: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-18 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-660 Summary ======= The package lib32-libcurl-compat before version 7.59.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.59.0-1. # pacman -Syu "lib32-libcurl-compat>=7.59.0-1" The problems have been fixed upstream in version 7.59.0. Workaround ========== None. Description =========== - CVE-2018-1000120 (denial of service) It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash, or an unspecified behavior. - CVE-2018-1000121 (denial of service) A NULL pointer dereference exists in the LDAP code of curl >= 7.21.0 and < curl 7.59.0, allowing an attacker to cause a denial of service. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server. - CVE-2018-1000122 (information disclosure) A buffer over-read exists in curl >= 7.20.0 and < 7.59.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this. Impact ====== A remote attacker is able to crash the application or disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-9cd6.html https://curl.haxx.se/CVE-2018-1000120.patch https://github.com/curl/curl/commit/535432c0adb62fe167ec09621500470b6fa4eb0f https://curl.haxx.se/docs/adv_2018-97a2.html https://curl.haxx.se/CVE-2018-1000121.patch https://github.com/curl/curl/commit/9889db043393092e9d4b5a42720bba0b3d58deba https://curl.haxx.se/docs/adv_2018-b047.html https://curl.haxx.se/CVE-2018-1000122.patch https://github.com/curl/curl/commit/d52dc4760f6d9ca1937eefa2093058a952465128 https://security.archlinux.org/CVE-2018-1000120 https://security.archlinux.org/CVE-2018-1000121 https://security.archlinux.org/CVE-2018-1000122

1 0

[ASA-201803-17] libcurl-compat: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-17 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-655 Summary ======= The package libcurl-compat before version 7.59.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.59.0-1. # pacman -Syu "libcurl-compat>=7.59.0-1" The problems have been fixed upstream in version 7.59.0. Workaround ========== None. Description =========== - CVE-2018-1000120 (denial of service) It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash, or an unspecified behavior. - CVE-2018-1000121 (denial of service) A NULL pointer dereference exists in the LDAP code of curl >= 7.21.0 and < curl 7.59.0, allowing an attacker to cause a denial of service. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server. - CVE-2018-1000122 (information disclosure) A buffer over-read exists in curl >= 7.20.0 and < 7.59.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this. Impact ====== A remote attacker is able to crash the application or disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-9cd6.html https://curl.haxx.se/CVE-2018-1000120.patch https://github.com/curl/curl/commit/535432c0adb62fe167ec09621500470b6fa4eb0f https://curl.haxx.se/docs/adv_2018-97a2.html https://curl.haxx.se/CVE-2018-1000121.patch https://github.com/curl/curl/commit/9889db043393092e9d4b5a42720bba0b3d58deba https://curl.haxx.se/docs/adv_2018-b047.html https://curl.haxx.se/CVE-2018-1000122.patch https://github.com/curl/curl/commit/d52dc4760f6d9ca1937eefa2093058a952465128 https://security.archlinux.org/CVE-2018-1000120 https://security.archlinux.org/CVE-2018-1000121 https://security.archlinux.org/CVE-2018-1000122

1 0

[ASA-201803-16] lib32-curl: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-16 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-654 Summary ======= The package lib32-curl before version 7.59.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.59.0-1. # pacman -Syu "lib32-curl>=7.59.0-1" The problems have been fixed upstream in version 7.59.0. Workaround ========== None. Description =========== - CVE-2018-1000120 (denial of service) It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash, or an unspecified behavior. - CVE-2018-1000121 (denial of service) A NULL pointer dereference exists in the LDAP code of curl >= 7.21.0 and < curl 7.59.0, allowing an attacker to cause a denial of service. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server. - CVE-2018-1000122 (information disclosure) A buffer over-read exists in curl >= 7.20.0 and < 7.59.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this. Impact ====== A remote attacker is able to crash the application or disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-9cd6.html https://curl.haxx.se/CVE-2018-1000120.patch https://github.com/curl/curl/commit/535432c0adb62fe167ec09621500470b6fa4eb0f https://curl.haxx.se/docs/adv_2018-97a2.html https://curl.haxx.se/CVE-2018-1000121.patch https://github.com/curl/curl/commit/9889db043393092e9d4b5a42720bba0b3d58deba https://curl.haxx.se/docs/adv_2018-b047.html https://curl.haxx.se/CVE-2018-1000122.patch https://github.com/curl/curl/commit/d52dc4760f6d9ca1937eefa2093058a952465128 https://security.archlinux.org/CVE-2018-1000120 https://security.archlinux.org/CVE-2018-1000121 https://security.archlinux.org/CVE-2018-1000122

1 0

[ASA-201803-15] curl: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-15 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-653 Summary ======= The package curl before version 7.59.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.59.0-1. # pacman -Syu "curl>=7.59.0-1" The problems have been fixed upstream in version 7.59.0. Workaround ========== None. Description =========== - CVE-2018-1000120 (denial of service) It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash, or an unspecified behavior. - CVE-2018-1000121 (denial of service) A NULL pointer dereference exists in the LDAP code of curl >= 7.21.0 and < curl 7.59.0, allowing an attacker to cause a denial of service. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server. - CVE-2018-1000122 (information disclosure) A buffer over-read exists in curl >= 7.20.0 and < 7.59.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this. Impact ====== A remote attacker is able to crash the application or disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-9cd6.html https://curl.haxx.se/CVE-2018-1000120.patch https://github.com/curl/curl/commit/535432c0adb62fe167ec09621500470b6fa4eb0f https://curl.haxx.se/docs/adv_2018-97a2.html https://curl.haxx.se/CVE-2018-1000121.patch https://github.com/curl/curl/commit/9889db043393092e9d4b5a42720bba0b3d58deba https://curl.haxx.se/docs/adv_2018-b047.html https://curl.haxx.se/CVE-2018-1000122.patch https://github.com/curl/curl/commit/d52dc4760f6d9ca1937eefa2093058a952465128 https://security.archlinux.org/CVE-2018-1000120 https://security.archlinux.org/CVE-2018-1000121 https://security.archlinux.org/CVE-2018-1000122

1 0

[ASA-201803-14] clamav: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-14 ========================================== Severity: Critical Date : 2018-03-18 CVE-ID : CVE-2012-6706 CVE-2017-6419 CVE-2017-11423 CVE-2018-0202 CVE-2018-1000085 Package : clamav Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-602 Summary ======= The package clamav before version 0.99.4-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.99.4-1. # pacman -Syu "clamav>=0.99.4-1" The problems have been fixed upstream in version 0.99.4. Workaround ========== None. Description =========== - CVE-2012-6706 (arbitrary code execution) A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos]. - CVE-2017-6419 (arbitrary code execution) mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV before 0.99.4, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code via a crafted CHM file. - CVE-2017-11423 (denial of service) The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV before 0.99.4 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. - CVE-2018-0202 (arbitrary code execution) A heap overflow has been discovered in ClamAv before 0.99.4 in pdf_parse_string possibly leading to arbitrary code execution by inspecting a specially crafted PDF file. - CVE-2018-1000085 (denial of service) A heap-based out-of-bounds read has been found in the xar_hash_check function of the xar decoder of ClamAV before 0.99.4, leading to a denial of service. Impact ====== A remote attacker can cause a denial of service or execute arbitrary code on the affected host by submitting a crafted file for inspection by ClamAV. References ========== http://www.openwall.com/lists/oss-security/2017/06/21/9 https://bugs.chromium.org/p/project-zero/issues/detail?id=1286 https://github.com/Cisco-Talos/clamav-devel/commit/d4699442bce76574573dc564… https://bugzilla.clamav.net/show_bug.cgi?id=11701 https://github.com/Cisco-Talos/clamav-devel/commit/a83773682e856ad6529ba6db… https://github.com/kyz/libmspack/commit/6139a0b9e93fcb7fcf423e56aa825bc869e… https://bugzilla.clamav.net/show_bug.cgi?id=11873 https://github.com/kyz/libmspack/commit/17038206fcc384dcee6dd9e3a75f08fd3dd… https://github.com/Cisco-Talos/clamav-devel/commit/ffa31264a657618a0e40c51c… https://github.com/Cisco-Talos/clamav-devel/commit/ada5f94e5cfb04e1ac2a6f38… https://github.com/hackerlib/hackerlib-vul/tree/master/clamav-vul https://bugzilla.clamav.net/show_bug.cgi?id=11973 https://bugzilla.clamav.net/show_bug.cgi?id=11980 https://github.com/Cisco-Talos/clamav-devel/commit/87aaa10b29476958f5bf54b6… https://github.com/Cisco-Talos/clamav-devel/commit/700ed96af56077cb1a9bff7b… https://github.com/Cisco-Talos/clamav-devel/commit/0df2fedf2805e574512c486b… https://github.com/Cisco-Talos/clamav-devel/commit/495fce917445063d519f14b0… https://github.com/Cisco-Talos/clamav-devel/commit/99eadf7a9ad3512101653123… http://www.openwall.com/lists/oss-security/2017/09/29/4 https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e387620… https://bugzilla.clamav.net/show_bug.cgi?id=11588 https://security.archlinux.org/CVE-2012-6706 https://security.archlinux.org/CVE-2017-6419 https://security.archlinux.org/CVE-2017-11423 https://security.archlinux.org/CVE-2018-0202 https://security.archlinux.org/CVE-2018-1000085

1 0

[ASA-201803-13] firefox: arbitrary code execution
by Jelle van der Waa 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-13 ========================================== Severity: Critical Date : 2018-03-18 CVE-ID : CVE-2018-5146 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-657 Summary ======= The package firefox before version 59.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 59.0.1-1. # pacman -Syu "firefox>=59.0.1-1" The problem has been fixed upstream in version 59.0.1. Workaround ========== None. Description =========== An out of bounds memory write vulnerability has been discovered in libvorbis before 1.3.6 while processing Vorbis audio data related to codebooks that are not an exact divisor of the partition size. Impact ====== A remote attacker is able to execute arbitrary code by tricking the user into visiting a website with a vorbis audio file. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/#CVE-2018-5146 https://bugzilla.mozilla.org/show_bug.cgi?id=1446062 https://github.com/xiph/vorbis/commit/667ceb4aab60c1f74060143bb24e5f427b3cc… http://seclists.org/oss-sec/2018/q1/243 https://security.archlinux.org/CVE-2018-5146

1 0

[ASA-201803-12] libvorbis: multiple issues
by Jelle van der Waa 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-12 ========================================== Severity: Critical Date : 2018-03-16 CVE-ID : CVE-2017-14632 CVE-2017-14633 CVE-2018-5146 Package : libvorbis Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-367 Summary ======= The package libvorbis before version 1.3.6-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.3.6-1. # pacman -Syu "libvorbis>=1.3.6-1" The problems have been fixed upstream in version 1.3.6. Workaround ========== None. Description =========== - CVE-2017-14632 (arbitrary code execution) fXiph.Org libvorbis before 1.3.6 allows remote code execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. - CVE-2017-14633 (denial of service) In Xiph.Org libvorbis before 1.3.6, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). - CVE-2018-5146 (arbitrary code execution) An out of bounds memory write vulnerability has been discovered in libvorbis before 1.3.6 while processing Vorbis audio data related to codebooks that are not an exact divisor of the partition size. Impact ====== A remote attacker is able to execute arbitrary code or crash the application by tricking the user into playing a specially crafted vorbis file. References ========== https://github.com/xiph/vorbis/commit/c1c2831fc7306d5fbd7bc800324efd12b28d3… https://github.com/xiph/vorbis/commit/a79ec216cd119069c68b8f3542c6a425a74ab… https://github.com/xiph/vorbis/commit/667ceb4aab60c1f74060143bb24e5f427b3cc… http://seclists.org/oss-sec/2018/q1/243 https://security.archlinux.org/CVE-2017-14632 https://security.archlinux.org/CVE-2017-14633 https://security.archlinux.org/CVE-2018-5146

1 0

[ASA-201803-11] ntp: multiple issues
by Remi Gacogne 18 Mar '18

18 Mar '18

Arch Linux Security Advisory ASA-201803-11 ========================================== Severity: High Date : 2018-03-16 CVE-ID : CVE-2016-1549 CVE-2018-7170 CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185 Package : ntp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-647 Summary ======= The package ntp before version 4.2.8.p11-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and denial of service. Resolution ========== Upgrade to 4.2.8.p11-1. # pacman -Syu "ntp>=4.2.8.p11-1" The problems have been fixed upstream in version 4.2.8.p11. Workaround ========== None. Description =========== - CVE-2016-1549 (content spoofing) A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock. - CVE-2018-7170 (content spoofing) ntpd can be vulnerable to Sybil attacks. If a system is set up to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer -- i.e. one where the attacker knows the private symmetric key -- can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock. - CVE-2018-7182 (denial of service) ctl_getitem() is used by ntpd to process incoming mode 6 packets. A malicious mode 6 packet can be sent to an ntpd instance, and if the ntpd instance is from 4.2.8p6 thru 4.2.8p10, that will cause ctl_getitem() to read past the end of its buffer. - CVE-2018-7183 (arbitrary code execution) ntpq is a monitoring and control program for ntpd. decodearr() is an internal function of ntpq that is used to -- wait for it -- decode an array in a response string when formatted data is being displayed. This is a problem in affected versions of ntpq if a maliciously-altered ntpd returns an array result that will trip this bug, or if a bad actor is able to read an ntpq request on its way to a remote ntpd server and forge and send a response before the remote ntpd sends its response. It's potentially possible that the malicious data could become injectable/executable code. - CVE-2018-7184 (denial of service) The fix for NtpBug2952 was incomplete, and while it fixed one problem it created another. Specifically, it drops bad packets before updating the "received" timestamp. This means a third-party can inject a packet with a zero-origin timestamp, meaning the sender wants to reset the association, and the transmit timestamp in this bogus packet will be saved as the most recent "received" timestamp. The real remote peer does not know this value and this will disrupt the association until the association resets. - CVE-2018-7185 (denial of service) The NTP Protocol allows for both non-authenticated and authenticated associations, in client/server, symmetric (peer), and several broadcast modes. In addition to the basic NTP operational modes, symmetric mode and broadcast servers can support an interleaved mode of operation. In ntp-4.2.8p4 a bug was inadvertently introduced into the protocol engine that allows a non-authenticated zero-origin (reset) packet to reset an authenticated interleaved peer association. If an attacker can send a packet with a zero-origin timestamp and the source IP address of the "other side" of an interleaved association, the 'victim' ntpd will reset its association. The attacker must continue sending these packets in order to maintain the disruption of the association. In ntp-4.0.0 thru ntp-4.2.8p6, interleave mode could be entered dynamically. As of ntp-4.2.8p7, interleaved mode must be explicitly configured/enabled. Impact ====== A remote, non-authenticated peer can cause a denial of service, preventing the vulnerable host from getting a correct time. In addition to that, a remote, authenticated peer can spoof the correct time, causing the vulnerable host to update its clock with an invalid time. A malicious NTPd server, or an attacker in position of man-in-the- middle might be able to execute arbitrary code on the affected host by forging a response to an ntpq request. References ========== http://support.ntp.org/bin/view/Main/NtpBug3012 http://support.ntp.org/bin/view/Main/NtpBug3415 http://support.ntp.org/bin/view/Main/NtpBug3412 http://support.ntp.org/bin/view/Main/NtpBug3414 http://support.ntp.org/bin/view/Main/NtpBug3453 http://support.ntp.org/bin/view/Main/NtpBug3454 https://security.archlinux.org/CVE-2016-1549 https://security.archlinux.org/CVE-2018-7170 https://security.archlinux.org/CVE-2018-7182 https://security.archlinux.org/CVE-2018-7183 https://security.archlinux.org/CVE-2018-7184 https://security.archlinux.org/CVE-2018-7185

1 0

[ASA-201803-10] samba: multiple issues
by Jelle van der Waa 14 Mar '18

14 Mar '18

Arch Linux Security Advisory ASA-201803-10 ========================================== Severity: Critical Date : 2018-03-13 CVE-ID : CVE-2018-1050 CVE-2018-1057 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-651 Summary ======= The package samba before version 4.7.6-1 is vulnerable to multiple issues including access restriction bypass and denial of service. Resolution ========== Upgrade to 4.7.6-1. # pacman -Syu "samba>=4.7.6-1" The problems have been fixed upstream in version 4.7.6. Workaround ========== - CVE-2018-1050 Ensure the parameter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf. - CVE-2018-1057 Revoke the change passwords right for 'the world' from all user objects (including computers) in the directory, leaving only the right to change a user's own password. Description =========== - CVE-2018-1050 (denial of service) All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash. - CVE-2018-1057 (access restriction bypass) On a Samba 4 AD DC any authenticated user can change other users' passwords over LDAP, including the passwords of administrative users and service accounts. Impact ====== A remote attacker is able to change other users passwords on a Samba 4 AD DC or perform a denial of service attack by sending a specially crafted request to the spoolss service. References ========== https://lists.samba.org/archive/samba-announce/2018/000435.html https://www.samba.org/samba/security/CVE-2018-1050.html https://github.com/samba-team/samba/commit/c41895be8222199ffe69749e32afc994… https://www.samba.org/samba/security/CVE-2018-1057.html https://wiki.samba.org/index.php/CVE-2018-1057 https://github.com/samba-team/samba/commit/50e7788603b97104fe116a07ab14a1d1… https://github.com/samba-team/samba/commit/c80456855197f9fe9ef497a7fc94504c… https://github.com/samba-team/samba/commit/ab7dc210e9aedc1222055822ff296e4a… https://github.com/samba-team/samba/commit/407a34c73fcd666c22776bbc4aa56d02… https://github.com/samba-team/samba/commit/3e6621fe58014f19477633b1c0b54288… https://github.com/samba-team/samba/commit/9dd7dd9ebba8d449feea66695fab3cbb… https://github.com/samba-team/samba/commit/766ab4c52b06532f2dd8801ccf5d4aad… https://github.com/samba-team/samba/commit/0e15ce12e1e9733f1e8eb13e77cbcdd0… https://github.com/samba-team/samba/commit/39e689aa703536330083bfc4d58d15a2… https://github.com/samba-team/samba/commit/2fea9ee701fed0417d8f681238663b7b… https://github.com/samba-team/samba/commit/c653e51a3d991e0e08327186881b324b… https://github.com/samba-team/samba/commit/b23bf04caeb196da9515addbcdf17db0… https://github.com/samba-team/samba/commit/fbd16473ecf073f86e36f9e29a801512… https://security.archlinux.org/CVE-2018-1050 https://security.archlinux.org/CVE-2018-1057

1 0

[ASA-201803-9] postgresql: privilege escalation
by Jelle van der Waa 14 Mar '18

14 Mar '18

Arch Linux Security Advisory ASA-201803-9 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-1058 Package : postgresql Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-643 Summary ======= The package postgresql before version 10.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 10.3-1. # pacman -Syu "postgresql>=10.3-1" The problem has been fixed upstream in version 10.3. Workaround ========== None. Description =========== A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected. Impact ====== A remote attacker with a valid user account is able to execute code with permissions of a superuser of the database. References ========== https://www.postgresql.org/about/news/1834/ https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Sea… https://security.archlinux.org/CVE-2018-1058

1 0