- Arch-security - lists.archlinux.org

[ASA-201803-11] ntp: multiple issues
by Remi Gacogne 18 Mar '18

18 Mar '18

Arch Linux Security Advisory ASA-201803-11 ========================================== Severity: High Date : 2018-03-16 CVE-ID : CVE-2016-1549 CVE-2018-7170 CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185 Package : ntp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-647 Summary ======= The package ntp before version 4.2.8.p11-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and denial of service. Resolution ========== Upgrade to 4.2.8.p11-1. # pacman -Syu "ntp>=4.2.8.p11-1" The problems have been fixed upstream in version 4.2.8.p11. Workaround ========== None. Description =========== - CVE-2016-1549 (content spoofing) A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock. - CVE-2018-7170 (content spoofing) ntpd can be vulnerable to Sybil attacks. If a system is set up to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer -- i.e. one where the attacker knows the private symmetric key -- can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock. - CVE-2018-7182 (denial of service) ctl_getitem() is used by ntpd to process incoming mode 6 packets. A malicious mode 6 packet can be sent to an ntpd instance, and if the ntpd instance is from 4.2.8p6 thru 4.2.8p10, that will cause ctl_getitem() to read past the end of its buffer. - CVE-2018-7183 (arbitrary code execution) ntpq is a monitoring and control program for ntpd. decodearr() is an internal function of ntpq that is used to -- wait for it -- decode an array in a response string when formatted data is being displayed. This is a problem in affected versions of ntpq if a maliciously-altered ntpd returns an array result that will trip this bug, or if a bad actor is able to read an ntpq request on its way to a remote ntpd server and forge and send a response before the remote ntpd sends its response. It's potentially possible that the malicious data could become injectable/executable code. - CVE-2018-7184 (denial of service) The fix for NtpBug2952 was incomplete, and while it fixed one problem it created another. Specifically, it drops bad packets before updating the "received" timestamp. This means a third-party can inject a packet with a zero-origin timestamp, meaning the sender wants to reset the association, and the transmit timestamp in this bogus packet will be saved as the most recent "received" timestamp. The real remote peer does not know this value and this will disrupt the association until the association resets. - CVE-2018-7185 (denial of service) The NTP Protocol allows for both non-authenticated and authenticated associations, in client/server, symmetric (peer), and several broadcast modes. In addition to the basic NTP operational modes, symmetric mode and broadcast servers can support an interleaved mode of operation. In ntp-4.2.8p4 a bug was inadvertently introduced into the protocol engine that allows a non-authenticated zero-origin (reset) packet to reset an authenticated interleaved peer association. If an attacker can send a packet with a zero-origin timestamp and the source IP address of the "other side" of an interleaved association, the 'victim' ntpd will reset its association. The attacker must continue sending these packets in order to maintain the disruption of the association. In ntp-4.0.0 thru ntp-4.2.8p6, interleave mode could be entered dynamically. As of ntp-4.2.8p7, interleaved mode must be explicitly configured/enabled. Impact ====== A remote, non-authenticated peer can cause a denial of service, preventing the vulnerable host from getting a correct time. In addition to that, a remote, authenticated peer can spoof the correct time, causing the vulnerable host to update its clock with an invalid time. A malicious NTPd server, or an attacker in position of man-in-the- middle might be able to execute arbitrary code on the affected host by forging a response to an ntpq request. References ========== http://support.ntp.org/bin/view/Main/NtpBug3012 http://support.ntp.org/bin/view/Main/NtpBug3415 http://support.ntp.org/bin/view/Main/NtpBug3412 http://support.ntp.org/bin/view/Main/NtpBug3414 http://support.ntp.org/bin/view/Main/NtpBug3453 http://support.ntp.org/bin/view/Main/NtpBug3454 https://security.archlinux.org/CVE-2016-1549 https://security.archlinux.org/CVE-2018-7170 https://security.archlinux.org/CVE-2018-7182 https://security.archlinux.org/CVE-2018-7183 https://security.archlinux.org/CVE-2018-7184 https://security.archlinux.org/CVE-2018-7185

1 0

[ASA-201803-10] samba: multiple issues
by Jelle van der Waa 14 Mar '18

14 Mar '18

Arch Linux Security Advisory ASA-201803-10 ========================================== Severity: Critical Date : 2018-03-13 CVE-ID : CVE-2018-1050 CVE-2018-1057 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-651 Summary ======= The package samba before version 4.7.6-1 is vulnerable to multiple issues including access restriction bypass and denial of service. Resolution ========== Upgrade to 4.7.6-1. # pacman -Syu "samba>=4.7.6-1" The problems have been fixed upstream in version 4.7.6. Workaround ========== - CVE-2018-1050 Ensure the parameter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf. - CVE-2018-1057 Revoke the change passwords right for 'the world' from all user objects (including computers) in the directory, leaving only the right to change a user's own password. Description =========== - CVE-2018-1050 (denial of service) All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash. - CVE-2018-1057 (access restriction bypass) On a Samba 4 AD DC any authenticated user can change other users' passwords over LDAP, including the passwords of administrative users and service accounts. Impact ====== A remote attacker is able to change other users passwords on a Samba 4 AD DC or perform a denial of service attack by sending a specially crafted request to the spoolss service. References ========== https://lists.samba.org/archive/samba-announce/2018/000435.html https://www.samba.org/samba/security/CVE-2018-1050.html https://github.com/samba-team/samba/commit/c41895be8222199ffe69749e32afc994… https://www.samba.org/samba/security/CVE-2018-1057.html https://wiki.samba.org/index.php/CVE-2018-1057 https://github.com/samba-team/samba/commit/50e7788603b97104fe116a07ab14a1d1… https://github.com/samba-team/samba/commit/c80456855197f9fe9ef497a7fc94504c… https://github.com/samba-team/samba/commit/ab7dc210e9aedc1222055822ff296e4a… https://github.com/samba-team/samba/commit/407a34c73fcd666c22776bbc4aa56d02… https://github.com/samba-team/samba/commit/3e6621fe58014f19477633b1c0b54288… https://github.com/samba-team/samba/commit/9dd7dd9ebba8d449feea66695fab3cbb… https://github.com/samba-team/samba/commit/766ab4c52b06532f2dd8801ccf5d4aad… https://github.com/samba-team/samba/commit/0e15ce12e1e9733f1e8eb13e77cbcdd0… https://github.com/samba-team/samba/commit/39e689aa703536330083bfc4d58d15a2… https://github.com/samba-team/samba/commit/2fea9ee701fed0417d8f681238663b7b… https://github.com/samba-team/samba/commit/c653e51a3d991e0e08327186881b324b… https://github.com/samba-team/samba/commit/b23bf04caeb196da9515addbcdf17db0… https://github.com/samba-team/samba/commit/fbd16473ecf073f86e36f9e29a801512… https://security.archlinux.org/CVE-2018-1050 https://security.archlinux.org/CVE-2018-1057

1 0

[ASA-201803-9] postgresql: privilege escalation
by Jelle van der Waa 14 Mar '18

14 Mar '18

Arch Linux Security Advisory ASA-201803-9 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-1058 Package : postgresql Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-643 Summary ======= The package postgresql before version 10.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 10.3-1. # pacman -Syu "postgresql>=10.3-1" The problem has been fixed upstream in version 10.3. Workaround ========== None. Description =========== A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected. Impact ====== A remote attacker with a valid user account is able to execute code with permissions of a superuser of the database. References ========== https://www.postgresql.org/about/news/1834/ https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Sea… https://security.archlinux.org/CVE-2018-1058

1 0

[ASA-201803-8] calibre: arbitrary command execution
by Jelle van der Waa 13 Mar '18

13 Mar '18

Arch Linux Security Advisory ASA-201803-8 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-7889 Package : calibre Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-650 Summary ======= The package calibre before version 3.19.0-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.19.0-1. # pacman -Syu "calibre>=3.19.0-1" The problem has been fixed upstream in version 3.19.0. Workaround ========== None. Description =========== gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call. Impact ====== A remote attacker is able to execute arbitrary commands by tricking the user into importing a specially crafted bookmark. References ========== https://bugs.launchpad.net/calibre/+bug/1753870 https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf657951756688b3c72b… https://security.archlinux.org/CVE-2018-7889

1 0

[ASA-201803-7] dovecot: multiple issues
by Jelle van der Waa 13 Mar '18

13 Mar '18

Arch Linux Security Advisory ASA-201803-7 ========================================= Severity: High Date : 2018-03-06 CVE-ID : CVE-2017-14461 CVE-2017-15130 CVE-2017-15132 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-645 Summary ======= The package dovecot before version 2.3.0.1-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.3.0.1-1. # pacman -Syu "dovecot>=2.3.0.1-1" The problems have been fixed upstream in version 2.3.0.1. Workaround ========== None. Description =========== - CVE-2017-14461 (information disclosure) A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure of an email from another user or may cause an application crash. In order to trigger this vulnerability, an imap-authenticated attacker needs to send a specially crafted email message to the server. - CVE-2017-15130 (denial of service) A denial of service flaw was found in dovecot before 2.2.34 and 2.3.0.1. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage, causing imap-login/pop3-login VSZ limit to be reached and the process restarted. This happens only if Dovecot config has local_name { } or local { } configuration blocks and attacker uses randomly generated SNI servernames. - CVE-2017-15132 (denial of service) A flaw was found in dovecot before 2.2.34 and 2.3.0.1. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion. Impact ====== A remote attacker is able to crash the application or disclose information by sending a specially crafted email. References ========== https://www.dovecot.org/list/dovecot-news/2018-February/000371.html https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510 https://github.com/dovecot/core/commit/30dc856f7b97b75b0e0d69f5003d5d99a132… https://github.com/dovecot/core/commit/8d65e2345e1dbedb00b662ee0abd05be2e7e… https://github.com/dovecot/core/commit/b72d864b8c34cb21076214c0b28101baec53… https://github.com/dovecot/core/commit/e9b86842441a668b30796bff7d6082861457… https://github.com/dovecot/core/commit/f5cd17a27f0b666567747f8c921ebe102697… https://github.com/dovecot/core/commit/18a7a161c8dae6f630770a3cbab7374a0c3d… https://github.com/dovecot/core/commit/0ed696987e5e5d44e971da2a10f6275b276e… https://www.dovecot.org/list/dovecot-news/2018-February/000370.html https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8… https://security.archlinux.org/CVE-2017-14461 https://security.archlinux.org/CVE-2017-15130 https://security.archlinux.org/CVE-2017-15132

1 0

[ASA-201803-6] python2-django: denial of service
by Jelle van der Waa 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-6 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python2-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package python2-django before version 1.11.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.11-1. # pacman -Syu "python2-django>=1.11.11-1" The problems have been fixed upstream in version 1.11.11. Workaround ========== None. Description =========== - CVE-2018-7536 (denial of service) The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. - CVE-2018-7537 (denial of service) If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. Impact ====== A remote attacker is able to crash the application by providing specially crafted input. References ========== https://docs.djangoproject.com/en/dev/releases/1.11.11/ https://github.com/django/django/commit/8618271caa0b09daba39ff3b46567d33ae1… https://github.com/django/django/commit/97b7dd59bb8d6163239061e2022153c3415… https://security.archlinux.org/CVE-2018-7536 https://security.archlinux.org/CVE-2018-7537

1 1

[ASA-201803-5] python-django: denial of service
by Jelle van der Waa 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-5 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package python-django before version 1.11.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.11-1. # pacman -Syu "python-django>=1.11.11-1" The problems have been fixed upstream in version 1.11.11. Workaround ========== None. Description =========== - CVE-2018-7536 (denial of service) The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. - CVE-2018-7537 (denial of service) If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. Impact ====== A remote attacker is able to crash the application by providing specially crafted input. References ========== https://docs.djangoproject.com/en/dev/releases/1.11.11/ https://github.com/django/django/commit/8618271caa0b09daba39ff3b46567d33ae1… https://github.com/django/django/commit/97b7dd59bb8d6163239061e2022153c3415… https://security.archlinux.org/CVE-2018-7536 https://security.archlinux.org/CVE-2018-7537

1 0

[ASA-201803-4] dhcp: denial of service
by Santiago Torres-Arias 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-4 ========================================= Severity: High Date : 2018-03-05 CVE-ID : CVE-2018-5733 Package : dhcp Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-646 Summary ======= The package dhcp before version 4.4.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.4.1-1. # pacman -Syu "dhcp>=4.4.1-1" The problem has been fixed upstream in version 4.4.1. Workaround ========== None. Description =========== A denial of service flaw was found in the way dhcpd handled reference counting when processing client requests. A malicious DHCP client could use this flaw to trigger a reference count overflow on the server side, potentially causing dhcpd to crash, by sending large amounts of traffic. Impact ====== A remote attacker is able to crash the dhcpd process by sending large amounts of traffic. References ========== https://kb.isc.org/article/AA-01567 https://lists.isc.org/pipermail/dhcp-announce/2018-February/000418.html https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commitdiff;h=197b26f… https://bugs.isc.org/Public/Bug/Display.html?id=47140 https://security.archlinux.org/CVE-2018-5733

1 0

[ASA-201803-3] dhclient: denial of service
by Santiago Torres-Arias 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-3 ========================================= Severity: High Date : 2018-03-05 CVE-ID : CVE-2018-5732 Package : dhclient Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-648 Summary ======= The package dhclient before version 4.4.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.4.1-1. # pacman -Syu "dhclient>=4.4.1-1" The problem has been fixed upstream in version 4.4.1. Workaround ========== None. Description =========== An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet. Impact ====== A remote attacker is able to crash the dhclient processes via a crafted DHCP response packet. References ========== https://kb.isc.org/article/AA-01565 https://lists.isc.org/pipermail/dhcp-announce/2018-February/000418.html https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commitdiff;h=c593172… https://bugs.isc.org/Public/Bug/Display.html?id=47139 https://security.archlinux.org/CVE-2018-5732

1 0

[ASA-201803-2] mkinitcpio-busybox: arbitrary code execution
by Santiago Torres-Arias 05 Mar '18

05 Mar '18

Arch Linux Security Advisory ASA-201803-2 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : mkinitcpio-busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-514 Summary ======= The package mkinitcpio-busybox before version 1.28.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.28.1-1. # pacman -Syu "mkinitcpio-busybox>=1.28.1-1" The problem has been fixed upstream in version 1.28.1. Workaround ========== None. Description =========== In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. Impact ====== An attacker is able to execute arbitrary code by tricking the user into auto-completing a crafted filename. References ========== https://bugs.archlinux.org/task/56391 https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e… https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-… https://security.archlinux.org/CVE-2017-16544

1 0