- Arch-security - lists.archlinux.org

[arch-security] [ASA-201711-33] curl: information disclosure
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-33 ========================================== Severity: Medium Date : 2017-11-30 CVE-ID : CVE-2017-8817 Package : curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-524 Summary ======= The package curl before version 7.57.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.57.0-1. # pacman -Syu "curl>=7.57.0-1" The problem has been fixed upstream in version 7.57.0. Workaround ========== None. Description =========== A read out of bounds flaw has been found in the FTP wildcard function of libcurl >= 7.21.0 and < 7.57.0. libcurl's FTP wildcard matching feature, which is enabled with the `CURLOPT_WILDCARDMATCH` option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket (`[`) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard. For applications that use HTTP(S) URLs, allow libcurl to handle redirects and have FTP wildcards enabled, this flaw can be triggered by malicious servers that can redirect clients to a URL using such a wildcard pattern. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2017-ae72.html https://curl.haxx.se/CVE-2017-8817.patch https://github.com/curl/curl/commit/0b664ba968437715819bfe4c7ada5679d16ebbc3 https://security.archlinux.org/CVE-2017-8817

1 0

[arch-security] [ASA-201711-32] exim: multiple issues
by Levente Polyak 01 Dec '17

01 Dec '17

Arch Linux Security Advisory ASA-201711-32 ========================================== Severity: Critical Date : 2017-11-30 CVE-ID : CVE-2017-1000369 CVE-2017-10140 CVE-2017-16943 CVE-2017-16944 Package : exim Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-518 Summary ======= The package exim before version 4.89.1-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 4.89.1-1. # pacman -Syu "exim>=4.89.1-1" The problems have been fixed upstream in version 4.89.1. Workaround ========== None. Description =========== - CVE-2017-1000369 (denial of service) An uncontrolled resource consumption flaw has been discovered in Exim before 4.89.1. The use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed results in leaking memory. While Exim itself is not vulnerable to privilege escalation, this particular flaw can be used by the stackguard vulnerability to achieve privilege escalation. - CVE-2017-10140 (information disclosure) It was found that Berkeley DB reads the DB_CONFIG configuration file from the current working directory by default. This happens when calling db_create() with dbenv=NULL; or using the dbm_open() function. This behavior leads to a security vulnerability because in the case of setuid or setgid commands, excerpts of the file are revealed to the calling user (and maybe more harm could be done with specially crafted DB_CONFIG files). - CVE-2017-16943 (arbitrary code execution) The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands. - CVE-2017-16944 (denial of service) The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function. Impact ====== A remote attacker is able to crash the application or execute arbitrary code on the affected host. A local attacker is able to bypass access restrictions to obtain sensitive data from local files or bypass the stack guard to elevate privileges on the system. References ========== https://bugs.archlinux.org/task/56478 https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://git.exim.org/exim.git/commitdiff/65e061b76867a9ea7aeeb535341b790b90… https://access.redhat.com/security/vulnerabilities/stackguard http://seclists.org/oss-sec/2017/q2/452 http://www.postfix.org/announcements/postfix-3.2.2.html https://git.exim.org/exim.git/commitdiff/98bf975ca462bebeaa1325d72381847c51… http://openwall.com/lists/oss-security/2017/11/25/2 https://bugs.exim.org/show_bug.cgi?id=2199 https://git.exim.org/exim.git/commitdiff/4090d62a4b25782129cc1643596dc2f6e8… https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944 https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html https://bugs.exim.org/show_bug.cgi?id=2201 https://git.exim.org/exim.git/commitdiff/178ecb70987f024f0e775d87c2f8b2cf58… https://www.exploit-db.com/exploits/43184/ https://security.archlinux.org/CVE-2017-1000369 https://security.archlinux.org/CVE-2017-10140 https://security.archlinux.org/CVE-2017-16943 https://security.archlinux.org/CVE-2017-16944

1 0

[arch-security] [ASA-201711-31] powerdns-recursor: multiple issues
by Remi Gacogne 27 Nov '17

27 Nov '17

Arch Linux Security Advisory ASA-201711-31 ========================================== Severity: Medium Date : 2017-11-27 CVE-ID : CVE-2017-15090 CVE-2017-15092 CVE-2017-15093 CVE-2017-15094 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-520 Summary ======= The package powerdns-recursor before version 4.0.7-1 is vulnerable to multiple issues including cross-site scripting, denial of service and insufficient validation. Resolution ========== Upgrade to 4.0.7-1. # pacman -Syu "powerdns-recursor>=4.0.7-1" The problems have been fixed upstream in version 4.0.7. Workaround ========== It is possible to work around CVE-2017-15093 by disabling the ability to alter the configuration via the API by setting 'api-config-dir' to an empty value (default), or by marking the API read-only via the 'api- readonly' setting. Description =========== - CVE-2017-15090 (insufficient validation) An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 up to and including 4.0.5, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records. - CVE-2017-15092 (cross-site scripting) An issue has been found in the web interface of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content. - CVE-2017-15093 (insufficient validation) An issue has been found in the API of PowerDNS Recursor < 4.0.7, during a source code audit by Nixu. When 'api-config-dir' is set to a non- empty value, which is not the case by default, the API allows an authorized user to update the Recursor’s ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor’s configuration. - CVE-2017-15094 (denial of service) An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, during a code audit by Nixu, leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting 'dnssec' to a value other than 'off' or 'process-no-validate' (default). Impact ====== A remote, unauthenticated attacker can inject Javascript code into the web interface, or can cause a denial of service via crafted DNSSEC signatures. An attacker in position of man-in-the-middle can also bypass DNSSEC validation via a crafted signature. In addition to that, a remote authenticated attacker with access to the API can inject unexpected directives into the configuration file. References ========== http://seclists.org/oss-sec/2017/q4/329 https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/9aed598c9a0a8f9b3a2a9c2310023d56c4a… https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/fd30387c26144cda3a5ab50c3946635bec1… https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/badf9e8900428f21585f7f929aeddc87cd0… https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-201… https://github.com/PowerDNS/pdns/commit/e87fe3987ab9a3b900544a0fc3bcf41068e… https://security.archlinux.org/CVE-2017-15090 https://security.archlinux.org/CVE-2017-15092 https://security.archlinux.org/CVE-2017-15093 https://security.archlinux.org/CVE-2017-15094

1 0

[arch-security] [ASA-201711-30] powerdns: access restriction bypass
by Remi Gacogne 27 Nov '17

27 Nov '17

Arch Linux Security Advisory ASA-201711-30 ========================================== Severity: Low Date : 2017-11-27 CVE-ID : CVE-2017-15091 Package : powerdns Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-519 Summary ======= The package powerdns before version 4.0.5-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 4.0.5-1. # pacman -Syu "powerdns>=4.0.5-1" The problem has been fixed upstream in version 4.0.5. Workaround ========== None. Description =========== An issue has been found in the API component of PowerDNS Authoritative < 4.0.5, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the 'api-readonly' keyword. This missing check allows an attacker with valid API credentials could flush the cache, trigger a zone transfer or send a NOTIFY. Impact ====== A remote, authenticated attacker can flush the cache, trigger a zone transfer or send a NOTIFY through the API even though it was configured as read-only. References ========== http://seclists.org/oss-sec/2017/q4/329 https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisor… https://github.com/PowerDNS/pdns/commit/245a2c8211db2f6c5771f93671e4eb80d4e… https://security.archlinux.org/CVE-2017-15091

1 0

[arch-security] [ASA-201711-29] varnish: information disclosure
by Morten Linderud 26 Nov '17

26 Nov '17

Arch Linux Security Advisory ASA-201711-29 ========================================== Severity: Medium Date : 2017-11-26 CVE-ID : CVE-2017-8807 Package : varnish Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-502 Summary ======= The package varnish before version 5.2.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 5.2.1-1. # pacman -Syu "varnish>=5.2.1-1" The problem has been fixed upstream in version 5.2.1. Workaround ========== None. Description =========== vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects. Impact ====== A remote attacker is able to retrieve sensitive information from the process memory. References ========== https://bugs.archlinux.org/task/56376 https://varnish-cache.org/security/VSV00002.html https://github.com/varnishcache/varnish-cache/commit/176f8a075a963ffbfa56f1… https://github.com/varnishcache/varnish-cache/pull/2429 https://security.archlinux.org/CVE-2017-8807

1 0

[arch-security] [ASA-201711-28] jbig2dec: denial of service
by Morten Linderud 22 Nov '17

22 Nov '17

Arch Linux Security Advisory ASA-201711-28 ========================================== Severity: Medium Date : 2017-11-22 CVE-ID : CVE-2017-9216 Package : jbig2dec Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-517 Summary ======= The package jbig2dec before version 0.14-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.14-1. # pacman -Syu "jbig2dec>=0.14-1" The problem has been fixed upstream in version 0.14. Workaround ========== None. Description =========== libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file. Impact ====== A remote attacker is able to crash the application by providing an invalid file. References ========== https://bugs.archlinux.org/task/56405 https://bugs.ghostscript.com/show_bug.cgi?id=697934 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=3ebffb1d96ba0cac… https://security.archlinux.org/CVE-2017-9216

1 0

[arch-security] [ASA-201711-27] roundcubemail: arbitrary filesystem access
by Morten Linderud 21 Nov '17

21 Nov '17

Arch Linux Security Advisory ASA-201711-27 ========================================== Severity: High Date : 2017-11-21 CVE-ID : CVE-2017-16651 Package : roundcubemail Type : arbitrary filesystem access Remote : Yes Link : https://security.archlinux.org/AVG-506 Summary ======= The package roundcubemail before version 1.3.3-1 is vulnerable to arbitrary filesystem access. Resolution ========== Upgrade to 1.3.3-1. # pacman -Syu "roundcubemail>=1.3.3-1" The problem has been fixed upstream in version 1.3.3. Workaround ========== None. Description =========== Roundcube Webmail 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. Impact ====== A remote authenticated non-admin user is able to read arbitrary files on the affected host. References ========== https://github.com/roundcube/roundcubemail/commit/c90ad5a97784fb32683b8e3c2… https://github.com/roundcube/roundcubemail/issues/6026 https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.… https://security.archlinux.org/CVE-2017-16651

1 0

[arch-security] [ASA-201711-26] lib32-icu: arbitrary code execution
by Morten Linderud 20 Nov '17

20 Nov '17

Arch Linux Security Advisory ASA-201711-26 ========================================== Severity: Critical Date : 2017-11-20 CVE-ID : CVE-2017-14952 Package : lib32-icu Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-507 Summary ======= The package lib32-icu before version 60.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.1-1. # pacman -Syu "lib32-icu>=60.1-1" The problem has been fixed upstream in version 60.1. Workaround ========== None. Description =========== Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue. Impact ====== A remote attacker is able to execute arbitrary code on the affected host via a specially crafted string. References ========== http://bugs.icu-project.org/trac/changeset/40324/trunk/icu4c/source/i18n/zo… http://www.sourcebrella.com/blog/double-free-vulnerability-international-co… https://security.archlinux.org/CVE-2017-14952

1 0

[arch-security] [ASA-201711-25] icu: arbitrary code execution
by Morten Linderud 20 Nov '17

20 Nov '17

Arch Linux Security Advisory ASA-201711-25 ========================================== Severity: Critical Date : 2017-11-19 CVE-ID : CVE-2017-14952 Package : icu Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-504 Summary ======= The package icu before version 60.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.1-1. # pacman -Syu "icu>=60.1-1" The problem has been fixed upstream in version 60.1. Workaround ========== None. Description =========== Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue. Impact ====== A remote attacker is able to execute arbitrary code on the affected host via a specially crafted string. References ========== http://bugs.icu-project.org/trac/changeset/40324/trunk/icu4c/source/i18n/zo… http://www.sourcebrella.com/blog/double-free-vulnerability-international-co… https://security.archlinux.org/CVE-2017-14952

1 0

[arch-security] [ASA-201711-24] couchdb: multiple issues
by Morten Linderud 16 Nov '17

16 Nov '17

Arch Linux Security Advisory ASA-201711-24 ========================================== Severity: High Date : 2017-11-16 CVE-ID : CVE-2017-12635 CVE-2017-12636 Package : couchdb Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-495 Summary ======= The package couchdb before version 2.1.1-1 is vulnerable to multiple issues including privilege escalation and arbitrary command execution. Resolution ========== Upgrade to 2.1.1-1. # pacman -Syu "couchdb>=2.1.1-1" The problems have been fixed upstream in version 2.1.1. Workaround ========== None. Description =========== - CVE-2017-12635 (privilege escalation) Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (remote command execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges. - CVE-2017-12636 (arbitrary command execution) CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet. Impact ====== A remote authenticated non-admin user is able to escalate privileges and execute arbitrary commands on the affected host. References ========== https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf0… https://justi.cz/security/2017/11/14/couchdb-rce-npm.html https://github.com/apache/couchdb/commit/e01f3009b59a00d81dd1f6d4e807afab08… https://github.com/apache/couchdb/commit/da27d4dcc7a98c76486f97c356f1c0f4a6… https://security.archlinux.org/CVE-2017-12635 https://security.archlinux.org/CVE-2017-12636

1 0