- Arch-security - lists.archlinux.org

[arch-security] [ASA-201711-40] shadowsocks-libev: arbitrary command execution
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-40 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-15924 Package : shadowsocks-libev Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-474 Summary ======= The package shadowsocks-libev before version 3.1.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.1.1-1. # pacman -Syu "shadowsocks-libev>=3.1.1-1" The problem has been fixed upstream in version 3.1.1. Workaround ========== None. Description =========== In manager.c in ss-manager in shadowsocks-libev before 3.1.1, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions. Impact ====== A local attacker could send a specially crafted configuration request to localhost that, when processed by ss-manager, leads to the execution of arbitrary commands as the user running ss-manager. References ========== http://openwall.com/lists/oss-security/2017/10/13/2 https://github.com/shadowsocks/shadowsocks-libev/commit/c67d275803dc6ea22c5… https://github.com/shadowsocks/shadowsocks-libev/issues/1734 https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/ https://security.archlinux.org/CVE-2017-15924

1 0

[arch-security] [ASA-201711-39] procmail: arbitrary code execution
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-39 ========================================== Severity: Critical Date : 2017-11-30 CVE-ID : CVE-2017-16844 Package : procmail Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-515 Summary ======= The package procmail before version 3.22-9 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.22-9. # pacman -Syu "procmail>=3.22-9" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-based buffer overflow flaw was found in the loadbuf function in formisc.c in the formail utility in procmail <= 3.22 because of a hardcoded realloc size. When the buffer is too small, the function tries to resize it, but only by Bsize (=128) bytes which is not necessarily enough. A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail. Impact ====== A remote attacker could send a specially crafted email that, when processed by formail, could cause formail to crash or, possibly, execute arbitrary code as the user running formail. References ========== https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511 https://security.archlinux.org/CVE-2017-16844

1 0

[arch-security] [ASA-201711-38] lib32-libcurl-compat: multiple issues
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-38 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-8816 CVE-2017-8817 CVE-2017-8818 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-522 Summary ======= The package lib32-libcurl-compat before version 7.57.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.57.0-1. # pacman -Syu "lib32-libcurl-compat>=7.57.0-1" The problems have been fixed upstream in version 7.57.0. Workaround ========== None. Description =========== - CVE-2017-8816 (arbitrary code execution) A buffer overrun flaw has been found in libcurl > 7.15.4 and < 7.57.0, in the NTLM authentication code. The internal function `Curl_ntlm_core_mk_ntlmv2_hash` sums up the lengths of the user name + password (= SUM) and multiplies the sum by two (= SIZE) to figure out how large storage to allocate from the heap. The SUM value is subsequently used to iterate over the input and generate output into the storage buffer. On systems with a 32 bit `size_t`, the math to calculate SIZE triggers an integer overflow when the combined lengths of the user name and password is larger than 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a buffer overrun. This is only an issue on 32 bit systems. It also requires the user and password fields to use more than 2GB of memory combined, which in itself should be rare. - CVE-2017-8817 (information disclosure) A read out of bounds flaw has been found in the FTP wildcard function of libcurl >= 7.21.0 and < 7.57.0. libcurl's FTP wildcard matching feature, which is enabled with the `CURLOPT_WILDCARDMATCH` option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket (`[`) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard. For applications that use HTTP(S) URLs, allow libcurl to handle redirects and have FTP wildcards enabled, this flaw can be triggered by malicious servers that can redirect clients to a URL using such a wildcard pattern. - CVE-2017-8818 (arbitrary code execution) An out-of-bounds flaw has been found in the SSL related code of libcurl >= 7.56.0 and < 7.57.0. When allocating memory for a connection (the internal struct called connectdata), a certain amount of memory is allocated at the end of the struct to be used for SSL related structs. Those structs are used by the particular SSL library libcurl is built to use. The application can also tell libcurl which specific SSL library to use if it was built to support more than one. The math used to calculate the extra memory amount necessary for the SSL library was wrong on 32 bit systems, which made the allocated memory too small by 4 bytes. The last struct member of the last object within the memory area could then be outside of what was allocated. Accessing that member could lead to a crash or other undefined behaviors depending on what memory that is present there and how the particular SSL library decides to act on that memory content. Specifically the vulnerability is present if libcurl was built so that sizeof(long long *) < sizeof(long long) which as far as we are aware only happens in 32-bit builds. Impact ====== A remote attacker is able to crash the application, possibly disclose sensitive information or execute arbitrary code on the affected host. References ========== https://curl.haxx.se/docs/adv_2017-11e7.html https://curl.haxx.se/docs/adv_2017-ae72.html https://curl.haxx.se/docs/adv_2017-af0a.html https://curl.haxx.se/CVE-2017-8816.patch https://github.com/curl/curl/commit/7f2a1df6f5fc598750b2c6f34465c8d924db28cc https://curl.haxx.se/CVE-2017-8817.patch https://github.com/curl/curl/commit/0b664ba968437715819bfe4c7ada5679d16ebbc3 https://curl.haxx.se/CVE-2017-8818.patch https://github.com/curl/curl/commit/9b5e12a5491d2e6b68e0c88ca56f3a9ef9fba400 https://security.archlinux.org/CVE-2017-8816 https://security.archlinux.org/CVE-2017-8817 https://security.archlinux.org/CVE-2017-8818

1 0

[arch-security] [ASA-201711-37] lib32-libcurl-gnutls: multiple issues
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-37 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-8816 CVE-2017-8817 CVE-2017-8818 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-523 Summary ======= The package lib32-libcurl-gnutls before version 7.57.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.57.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.57.0-1" The problems have been fixed upstream in version 7.57.0. Workaround ========== None. Description =========== - CVE-2017-8816 (arbitrary code execution) A buffer overrun flaw has been found in libcurl > 7.15.4 and < 7.57.0, in the NTLM authentication code. The internal function `Curl_ntlm_core_mk_ntlmv2_hash` sums up the lengths of the user name + password (= SUM) and multiplies the sum by two (= SIZE) to figure out how large storage to allocate from the heap. The SUM value is subsequently used to iterate over the input and generate output into the storage buffer. On systems with a 32 bit `size_t`, the math to calculate SIZE triggers an integer overflow when the combined lengths of the user name and password is larger than 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a buffer overrun. This is only an issue on 32 bit systems. It also requires the user and password fields to use more than 2GB of memory combined, which in itself should be rare. - CVE-2017-8817 (information disclosure) A read out of bounds flaw has been found in the FTP wildcard function of libcurl >= 7.21.0 and < 7.57.0. libcurl's FTP wildcard matching feature, which is enabled with the `CURLOPT_WILDCARDMATCH` option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket (`[`) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard. For applications that use HTTP(S) URLs, allow libcurl to handle redirects and have FTP wildcards enabled, this flaw can be triggered by malicious servers that can redirect clients to a URL using such a wildcard pattern. - CVE-2017-8818 (arbitrary code execution) An out-of-bounds flaw has been found in the SSL related code of libcurl >= 7.56.0 and < 7.57.0. When allocating memory for a connection (the internal struct called connectdata), a certain amount of memory is allocated at the end of the struct to be used for SSL related structs. Those structs are used by the particular SSL library libcurl is built to use. The application can also tell libcurl which specific SSL library to use if it was built to support more than one. The math used to calculate the extra memory amount necessary for the SSL library was wrong on 32 bit systems, which made the allocated memory too small by 4 bytes. The last struct member of the last object within the memory area could then be outside of what was allocated. Accessing that member could lead to a crash or other undefined behaviors depending on what memory that is present there and how the particular SSL library decides to act on that memory content. Specifically the vulnerability is present if libcurl was built so that sizeof(long long *) < sizeof(long long) which as far as we are aware only happens in 32-bit builds. Impact ====== A remote attacker is able to crash the application, possibly disclose sensitive information or execute arbitrary code on the affected host. References ========== https://curl.haxx.se/docs/adv_2017-11e7.html https://curl.haxx.se/docs/adv_2017-ae72.html https://curl.haxx.se/docs/adv_2017-af0a.html https://curl.haxx.se/CVE-2017-8816.patch https://github.com/curl/curl/commit/7f2a1df6f5fc598750b2c6f34465c8d924db28cc https://curl.haxx.se/CVE-2017-8817.patch https://github.com/curl/curl/commit/0b664ba968437715819bfe4c7ada5679d16ebbc3 https://curl.haxx.se/CVE-2017-8818.patch https://github.com/curl/curl/commit/9b5e12a5491d2e6b68e0c88ca56f3a9ef9fba400 https://security.archlinux.org/CVE-2017-8816 https://security.archlinux.org/CVE-2017-8817 https://security.archlinux.org/CVE-2017-8818

1 0

[arch-security] [ASA-201711-36] lib32-curl: multiple issues
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-36 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-8816 CVE-2017-8817 CVE-2017-8818 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-521 Summary ======= The package lib32-curl before version 7.57.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.57.0-1. # pacman -Syu "lib32-curl>=7.57.0-1" The problems have been fixed upstream in version 7.57.0. Workaround ========== None. Description =========== - CVE-2017-8816 (arbitrary code execution) A buffer overrun flaw has been found in libcurl > 7.15.4 and < 7.57.0, in the NTLM authentication code. The internal function `Curl_ntlm_core_mk_ntlmv2_hash` sums up the lengths of the user name + password (= SUM) and multiplies the sum by two (= SIZE) to figure out how large storage to allocate from the heap. The SUM value is subsequently used to iterate over the input and generate output into the storage buffer. On systems with a 32 bit `size_t`, the math to calculate SIZE triggers an integer overflow when the combined lengths of the user name and password is larger than 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a buffer overrun. This is only an issue on 32 bit systems. It also requires the user and password fields to use more than 2GB of memory combined, which in itself should be rare. - CVE-2017-8817 (information disclosure) A read out of bounds flaw has been found in the FTP wildcard function of libcurl >= 7.21.0 and < 7.57.0. libcurl's FTP wildcard matching feature, which is enabled with the `CURLOPT_WILDCARDMATCH` option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket (`[`) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard. For applications that use HTTP(S) URLs, allow libcurl to handle redirects and have FTP wildcards enabled, this flaw can be triggered by malicious servers that can redirect clients to a URL using such a wildcard pattern. - CVE-2017-8818 (arbitrary code execution) An out-of-bounds flaw has been found in the SSL related code of libcurl >= 7.56.0 and < 7.57.0. When allocating memory for a connection (the internal struct called connectdata), a certain amount of memory is allocated at the end of the struct to be used for SSL related structs. Those structs are used by the particular SSL library libcurl is built to use. The application can also tell libcurl which specific SSL library to use if it was built to support more than one. The math used to calculate the extra memory amount necessary for the SSL library was wrong on 32 bit systems, which made the allocated memory too small by 4 bytes. The last struct member of the last object within the memory area could then be outside of what was allocated. Accessing that member could lead to a crash or other undefined behaviors depending on what memory that is present there and how the particular SSL library decides to act on that memory content. Specifically the vulnerability is present if libcurl was built so that sizeof(long long *) < sizeof(long long) which as far as we are aware only happens in 32-bit builds. Impact ====== A remote attacker is able to crash the application, possibly disclose sensitive information or execute arbitrary code on the affected host. References ========== https://curl.haxx.se/docs/adv_2017-11e7.html https://curl.haxx.se/docs/adv_2017-ae72.html https://curl.haxx.se/docs/adv_2017-af0a.html https://curl.haxx.se/CVE-2017-8816.patch https://github.com/curl/curl/commit/7f2a1df6f5fc598750b2c6f34465c8d924db28cc https://curl.haxx.se/CVE-2017-8817.patch https://github.com/curl/curl/commit/0b664ba968437715819bfe4c7ada5679d16ebbc3 https://curl.haxx.se/CVE-2017-8818.patch https://github.com/curl/curl/commit/9b5e12a5491d2e6b68e0c88ca56f3a9ef9fba400 https://security.archlinux.org/CVE-2017-8816 https://security.archlinux.org/CVE-2017-8817 https://security.archlinux.org/CVE-2017-8818

1 0

[arch-security] [ASA-201711-35] libcurl-compat: information disclosure
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-35 ========================================== Severity: Medium Date : 2017-11-30 CVE-ID : CVE-2017-8817 Package : libcurl-compat Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-526 Summary ======= The package libcurl-compat before version 7.57.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.57.0-1. # pacman -Syu "libcurl-compat>=7.57.0-1" The problem has been fixed upstream in version 7.57.0. Workaround ========== None. Description =========== A read out of bounds flaw has been found in the FTP wildcard function of libcurl >= 7.21.0 and < 7.57.0. libcurl's FTP wildcard matching feature, which is enabled with the `CURLOPT_WILDCARDMATCH` option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket (`[`) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard. For applications that use HTTP(S) URLs, allow libcurl to handle redirects and have FTP wildcards enabled, this flaw can be triggered by malicious servers that can redirect clients to a URL using such a wildcard pattern. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2017-ae72.html https://curl.haxx.se/CVE-2017-8817.patch https://github.com/curl/curl/commit/0b664ba968437715819bfe4c7ada5679d16ebbc3 https://security.archlinux.org/CVE-2017-8817

1 0

[arch-security] [ASA-201711-34] libcurl-gnutls: information disclosure
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-34 ========================================== Severity: Medium Date : 2017-11-30 CVE-ID : CVE-2017-8817 Package : libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-525 Summary ======= The package libcurl-gnutls before version 7.57.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.57.0-1. # pacman -Syu "libcurl-gnutls>=7.57.0-1" The problem has been fixed upstream in version 7.57.0. Workaround ========== None. Description =========== A read out of bounds flaw has been found in the FTP wildcard function of libcurl >= 7.21.0 and < 7.57.0. libcurl's FTP wildcard matching feature, which is enabled with the `CURLOPT_WILDCARDMATCH` option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket (`[`) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard. For applications that use HTTP(S) URLs, allow libcurl to handle redirects and have FTP wildcards enabled, this flaw can be triggered by malicious servers that can redirect clients to a URL using such a wildcard pattern. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2017-ae72.html https://curl.haxx.se/CVE-2017-8817.patch https://github.com/curl/curl/commit/0b664ba968437715819bfe4c7ada5679d16ebbc3 https://security.archlinux.org/CVE-2017-8817

1 0

[arch-security] [ASA-201711-33] curl: information disclosure
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-33 ========================================== Severity: Medium Date : 2017-11-30 CVE-ID : CVE-2017-8817 Package : curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-524 Summary ======= The package curl before version 7.57.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.57.0-1. # pacman -Syu "curl>=7.57.0-1" The problem has been fixed upstream in version 7.57.0. Workaround ========== None. Description =========== A read out of bounds flaw has been found in the FTP wildcard function of libcurl >= 7.21.0 and < 7.57.0. libcurl's FTP wildcard matching feature, which is enabled with the `CURLOPT_WILDCARDMATCH` option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket (`[`) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard. For applications that use HTTP(S) URLs, allow libcurl to handle redirects and have FTP wildcards enabled, this flaw can be triggered by malicious servers that can redirect clients to a URL using such a wildcard pattern. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2017-ae72.html https://curl.haxx.se/CVE-2017-8817.patch https://github.com/curl/curl/commit/0b664ba968437715819bfe4c7ada5679d16ebbc3 https://security.archlinux.org/CVE-2017-8817

1 0

[arch-security] [ASA-201711-32] exim: multiple issues
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-32 ========================================== Severity: Critical Date : 2017-11-30 CVE-ID : CVE-2017-1000369 CVE-2017-10140 CVE-2017-16943 CVE-2017-16944 Package : exim Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-518 Summary ======= The package exim before version 4.89.1-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 4.89.1-1. # pacman -Syu "exim>=4.89.1-1" The problems have been fixed upstream in version 4.89.1. Workaround ========== None. Description =========== - CVE-2017-1000369 (denial of service) An uncontrolled resource consumption flaw has been discovered in Exim before 4.89.1. The use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed results in leaking memory. While Exim itself is not vulnerable to privilege escalation, this particular flaw can be used by the stackguard vulnerability to achieve privilege escalation. - CVE-2017-10140 (information disclosure) It was found that Berkeley DB reads the DB_CONFIG configuration file from the current working directory by default. This happens when calling db_create() with dbenv=NULL; or using the dbm_open() function. This behavior leads to a security vulnerability because in the case of setuid or setgid commands, excerpts of the file are revealed to the calling user (and maybe more harm could be done with specially crafted DB_CONFIG files). - CVE-2017-16943 (arbitrary code execution) The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands. - CVE-2017-16944 (denial of service) The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function. Impact ====== A remote attacker is able to crash the application or execute arbitrary code on the affected host. A local attacker is able to bypass access restrictions to obtain sensitive data from local files or bypass the stack guard to elevate privileges on the system. References ========== https://bugs.archlinux.org/task/56478 https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://git.exim.org/exim.git/commitdiff/65e061b76867a9ea7aeeb535341b790b90… https://access.redhat.com/security/vulnerabilities/stackguard http://seclists.org/oss-sec/2017/q2/452 http://www.postfix.org/announcements/postfix-3.2.2.html https://git.exim.org/exim.git/commitdiff/98bf975ca462bebeaa1325d72381847c51… http://openwall.com/lists/oss-security/2017/11/25/2 https://bugs.exim.org/show_bug.cgi?id=2199 https://git.exim.org/exim.git/commitdiff/4090d62a4b25782129cc1643596dc2f6e8… https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944 https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html https://bugs.exim.org/show_bug.cgi?id=2201 https://git.exim.org/exim.git/commitdiff/178ecb70987f024f0e775d87c2f8b2cf58… https://www.exploit-db.com/exploits/43184/ https://security.archlinux.org/CVE-2017-1000369 https://security.archlinux.org/CVE-2017-10140 https://security.archlinux.org/CVE-2017-16943 https://security.archlinux.org/CVE-2017-16944

1 0

[arch-security] [ASA-201711-31] powerdns-recursor: multiple issues
by Remi Gacogne 27 Nov '17

27 Nov '17

Arch Linux Security Advisory ASA-201711-31 ========================================== Severity: Medium Date : 2017-11-27 CVE-ID : CVE-2017-15090 CVE-2017-15092 CVE-2017-15093 CVE-2017-15094 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-520 Summary ======= The package powerdns-recursor before version 4.0.7-1 is vulnerable to multiple issues including cross-site scripting, denial of service and insufficient validation. Resolution ========== Upgrade to 4.0.7-1. # pacman -Syu "powerdns-recursor>=4.0.7-1" The problems have been fixed upstream in version 4.0.7. Workaround ========== It is possible to work around CVE-2017-15093 by disabling the ability to alter the configuration via the API by setting 'api-config-dir' to an empty value (default), or by marking the API read-only via the 'api- readonly' setting. Description =========== - CVE-2017-15090 (insufficient validation) An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 up to and including 4.0.5, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records. - CVE-2017-15092 (cross-site scripting) An issue has been found in the web interface of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content. - CVE-2017-15093 (insufficient validation) An issue has been found in the API of PowerDNS Recursor < 4.0.7, during a source code audit by Nixu. When 'api-config-dir' is set to a non- empty value, which is not the case by default, the API allows an authorized user to update the Recursor’s ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor’s configuration. - CVE-2017-15094 (denial of service) An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, during a code audit by Nixu, leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting 'dnssec' to a value other than 'off' or 'process-no-validate' (default). Impact ====== A remote, unauthenticated attacker can inject Javascript code into the web interface, or can cause a denial of service via crafted DNSSEC signatures. An attacker in position of man-in-the-middle can also bypass DNSSEC validation via a crafted signature. In addition to that, a remote authenticated attacker with access to the API can inject unexpected directives into the configuration file. References ========== http://seclists.org/oss-sec/2017/q4/329 https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/9aed598c9a0a8f9b3a2a9c2310023d56c4a… https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/fd30387c26144cda3a5ab50c3946635bec1… https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/badf9e8900428f21585f7f929aeddc87cd0… https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/e87fe3987ab9a3b900544a0fc3bcf41068e… https://security.archlinux.org/CVE-2017-15090 https://security.archlinux.org/CVE-2017-15092 https://security.archlinux.org/CVE-2017-15093 https://security.archlinux.org/CVE-2017-15094

1 0