- Arch-security - lists.archlinux.org

[arch-security] [ASA-201710-24] linux-zen: privilege escalation
by Santiago Torres-Arias 17 Oct '17

17 Oct '17

Arch Linux Security Advisory ASA-201710-24 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-5123 Package : linux-zen Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-445 Summary ======= The package linux-zen before version 4.13.7-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.13.7-1. # pacman -Syu "linux-zen>=4.13.7-1" The problem has been fixed upstream in version 4.13.7. Workaround ========== None. Description =========== It was discovered that when the waitid() syscall in Linux kernel v4.13 was refactored, it accidentally stopped checking that the incoming argument was pointing to userspace. This allowed local attackers to write directly to kernel memory, which could lead to privilege escalation. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2017-5123

1 0

[arch-security] [ASA-201710-23] hostapd: man-in-the-middle
by Levente Polyak 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-23 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13087 CVE-2017-13088 Package : hostapd Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-448 Summary ======= The package hostapd before version 2.6-6 is vulnerable to man-in-the- middle. Resolution ========== Upgrade to 2.6-6. # pacman -Syu "hostapd>=2.6-6" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-13077 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake. - CVE-2017-13078 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the 4-way handshake. - CVE-2017-13079 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the 4-way handshake. - CVE-2017-13080 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the group key handshake. - CVE-2017-13081 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the group key handshake. - CVE-2017-13082 (man-in-the-middle) A vulnerability has been discovered that allows accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key (PTK) while processing it. - CVE-2017-13087 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. - CVE-2017-13088 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. Impact ====== A remote attacker within physical proximity to the target WiFi network is able to decrypt all data that the victim transmits, inject arbitrary packets to hijack TCP connection or replay unicast and group-addressed frames. References ========== https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… https://papers.mathyvanhoef.com/ccs2017.pdf https://www.kb.cert.org/vuls/id/228519 https://www.krackattacks.com/ https://w1.fi/cgit/hostap/commit/?id=53bb18cc8b7a4da72e47e4b3752d0d2135cffb… https://w1.fi/cgit/hostap/commit/?id=0adc9b28b39d414d5febfff752f6a1576f785c… https://w1.fi/cgit/hostap/commit/?id=cb5132bb35698cc0c743e34fe0e845dfc4c3e4… https://w1.fi/cgit/hostap/commit/?id=0e3bd7ac684a2289aa613347e2f3ad54ad6a94… https://w1.fi/cgit/hostap/commit/?id=e760851176c77ae6de19821bb1d5bf3ae2cb51… https://w1.fi/cgit/hostap/commit/?id=2a9c5217b18be9462a5329626e2f95cc7dd8d4… https://w1.fi/cgit/hostap/commit/?id=87e2db16bafcbc60b8d0016175814a73c1e8ed… https://security.archlinux.org/CVE-2017-13077 https://security.archlinux.org/CVE-2017-13078 https://security.archlinux.org/CVE-2017-13079 https://security.archlinux.org/CVE-2017-13080 https://security.archlinux.org/CVE-2017-13081 https://security.archlinux.org/CVE-2017-13082 https://security.archlinux.org/CVE-2017-13087 https://security.archlinux.org/CVE-2017-13088

1 0

[arch-security] [ASA-201710-22] wpa_supplicant: man-in-the-middle
by Levente Polyak 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-22 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13087 CVE-2017-13088 Package : wpa_supplicant Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-447 Summary ======= The package wpa_supplicant before version 1:2.6-11 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1:2.6-11. # pacman -Syu "wpa_supplicant>=1:2.6-11" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-13077 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake. - CVE-2017-13078 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the 4-way handshake. - CVE-2017-13079 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the 4-way handshake. - CVE-2017-13080 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the group key handshake. - CVE-2017-13081 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the group key handshake. - CVE-2017-13082 (man-in-the-middle) A vulnerability has been discovered that allows accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key (PTK) while processing it. - CVE-2017-13087 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. - CVE-2017-13088 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. Impact ====== A remote attacker within physical proximity to the target WiFi network is able to decrypt all data that the victim transmits, inject arbitrary packets to hijack TCP connection or replay unicast and group-addressed frames. References ========== https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… https://papers.mathyvanhoef.com/ccs2017.pdf https://www.kb.cert.org/vuls/id/228519 https://www.krackattacks.com/ https://w1.fi/cgit/hostap/commit/?id=53bb18cc8b7a4da72e47e4b3752d0d2135cffb… https://w1.fi/cgit/hostap/commit/?id=0adc9b28b39d414d5febfff752f6a1576f785c… https://w1.fi/cgit/hostap/commit/?id=cb5132bb35698cc0c743e34fe0e845dfc4c3e4… https://w1.fi/cgit/hostap/commit/?id=0e3bd7ac684a2289aa613347e2f3ad54ad6a94… https://w1.fi/cgit/hostap/commit/?id=e760851176c77ae6de19821bb1d5bf3ae2cb51… https://w1.fi/cgit/hostap/commit/?id=2a9c5217b18be9462a5329626e2f95cc7dd8d4… https://w1.fi/cgit/hostap/commit/?id=87e2db16bafcbc60b8d0016175814a73c1e8ed… https://security.archlinux.org/CVE-2017-13077 https://security.archlinux.org/CVE-2017-13078 https://security.archlinux.org/CVE-2017-13079 https://security.archlinux.org/CVE-2017-13080 https://security.archlinux.org/CVE-2017-13081 https://security.archlinux.org/CVE-2017-13082 https://security.archlinux.org/CVE-2017-13087 https://security.archlinux.org/CVE-2017-13088

1 0

[arch-security] [ASA-201710-21] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-21 ========================================== Severity: Critical Date : 2017-10-16 CVE-ID : CVE-2017-11292 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-450 Summary ======= The package lib32-flashplugin before version 27.0.0.170-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.170-1. # pacman -Syu "lib32-flashplugin>=27.0.0.170-1" The problem has been fixed upstream in version 27.0.0.170. Workaround ========== None. Description =========== A type confusion vulnerability has been found in Adobe Flash Player <= 27.0.0.159, leading to arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code on the affected host. Adobe is aware of a report that an exploit exists in the wild, and is being used in limited, targeted attacks against users running Windows. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-32.html https://security.archlinux.org/CVE-2017-11292

1 0

[arch-security] [ASA-201710-20] flashplugin: arbitrary code execution
by Remi Gacogne 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-20 ========================================== Severity: Critical Date : 2017-10-16 CVE-ID : CVE-2017-11292 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-449 Summary ======= The package flashplugin before version 27.0.0.170-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.170-1. # pacman -Syu "flashplugin>=27.0.0.170-1" The problem has been fixed upstream in version 27.0.0.170. Workaround ========== None. Description =========== A type confusion vulnerability has been found in Adobe Flash Player <= 27.0.0.159, leading to arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code on the affected host. Adobe is aware of a report that an exploit exists in the wild, and is being used in limited, targeted attacks against users running Windows. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-32.html https://security.archlinux.org/CVE-2017-11292

1 0

[arch-security] [ASA-201710-19] thunderbird: multiple issues
by Remi Gacogne 13 Oct '17

13 Oct '17

Arch Linux Security Advisory ASA-201710-19 ========================================== Severity: Critical Date : 2017-10-12 CVE-ID : CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-441 Summary ======= The package thunderbird before version 52.4.0-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass and cross-site scripting. Resolution ========== Upgrade to 52.4.0-1. # pacman -Syu "thunderbird>=52.4.0-1" The problems have been fixed upstream in version 52.4.0. Workaround ========== None. Description =========== - CVE-2017-7793 (arbitrary code execution) A use-after-free vulnerability can occur in the Fetch API of Thunderbird < 52.4, when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. - CVE-2017-7805 (arbitrary code execution) A security issue has been found in Thunderbird < 52.4. During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. - CVE-2017-7810 (arbitrary code execution) Mozilla developers and community members Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, and Sebastian Hengst reported memory safety bugs present in Firefox <= 55, Firefox ESR <= 52.3, and Thunderbird <= 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-7814 (access restriction bypass) A security issue has been found in Thunderbird < 52.4. File downloads encoded with blob: and data: URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. - CVE-2017-7818 (arbitrary code execution) A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM, in Thunderbird < 52.4. This results in a potentially exploitable crash. - CVE-2017-7819 (arbitrary code execution) A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory, in Thunderbird < 52.4. This results in a potentially exploitable crash. - CVE-2017-7823 (cross-site scripting) The content security policy (CSP) sandbox directive in Thunderbird < 52.4 did not create a unique origin for the document, causing it to behave as if the allow-same-origin keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. - CVE-2017-7824 (arbitrary code execution) A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content in Thunderbird < 52.4. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. Impact ====== A remote attacker can bypass security measures like the phishing and malware protection or a content security policy, and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-23 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7793 https://bugzilla.mozilla.org/show_bug.cgi?id=1371889 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7805 https://bugzilla.mozilla.org/show_bug.cgi?id=1377618 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7810 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1386787%2C1389974%2C1371657… https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7814 https://bugzilla.mozilla.org/show_bug.cgi?id=1376036 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7818 https://bugzilla.mozilla.org/show_bug.cgi?id=1363723 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7819 https://bugzilla.mozilla.org/show_bug.cgi?id=1380292 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7823 https://bugzilla.mozilla.org/show_bug.cgi?id=1396320 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7824 https://bugzilla.mozilla.org/show_bug.cgi?id=1398381 https://security.archlinux.org/CVE-2017-7793 https://security.archlinux.org/CVE-2017-7805 https://security.archlinux.org/CVE-2017-7810 https://security.archlinux.org/CVE-2017-7814 https://security.archlinux.org/CVE-2017-7818 https://security.archlinux.org/CVE-2017-7819 https://security.archlinux.org/CVE-2017-7823 https://security.archlinux.org/CVE-2017-7824

1 0

[arch-security] [ASA-201710-18] pcre2: denial of service
by Levente Polyak 13 Oct '17

13 Oct '17

Arch Linux Security Advisory ASA-201710-18 ========================================== Severity: Medium Date : 2017-10-12 CVE-ID : CVE-2017-7186 Package : pcre2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-223 Summary ======= The package pcre2 before version 10.30-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.30-1. # pacman -Syu "pcre2>=10.30-1" The problem has been fixed upstream in version 10.30. Workaround ========== None. Description =========== libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. Impact ====== A remote attacker is able to crash the application by triggering an invalid Unicode property lookup. References ========== https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date https://bugs.exim.org/show_bug.cgi?id=2052 https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-matc… https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&so… https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=… https://security.archlinux.org/CVE-2017-7186

1 0

[arch-security] [ASA-201710-17] botan: information disclosure
by Levente Polyak 13 Oct '17

13 Oct '17

Arch Linux Security Advisory ASA-201710-17 ========================================== Severity: Medium Date : 2017-10-12 CVE-ID : CVE-2017-14737 Package : botan Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-416 Summary ======= The package botan before version 2.3.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.3.0-1. # pacman -Syu "botan>=2.3.0-1" The problem has been fixed upstream in version 2.3.0. Workaround ========== None. Description =========== A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key. Impact ====== A local attacker is able to use a cache-based side channel attack to recover information about RSA secret keys. References ========== https://github.com/randombit/botan/issues/1222 https://github.com/randombit/botan/commit/95df7f155570949837e8e28e733f3d594… https://github.com/randombit/botan/commit/2718c02d429d024b2cd65534f7e54cab1… https://www.usenix.org/conference/usenixsecurity17/technical-sessions/prese… https://security.archlinux.org/CVE-2017-14737

1 0

[arch-security] [ASA-201710-16] go-pie: arbitrary command execution
by Levente Polyak 13 Oct '17

13 Oct '17

Arch Linux Security Advisory ASA-201710-16 ========================================== Severity: High Date : 2017-10-12 CVE-ID : CVE-2017-15041 Package : go-pie Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-442 Summary ======= The package go-pie before version 2:1.9.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2:1.9.1-1. # pacman -Syu "go-pie>=2:1.9.1-1" The problem has been fixed upstream in version 1.9.1. Workaround ========== None. Description =========== Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get". Impact ====== A remote attacker may be able to execute arbitrary commands on a system running "go get" by using a specially prepared repository. References ========== https://github.com/golang/go/issues/22125 https://github.com/golang/tools/commit/ebae2dcdbabadfdb9880a627481eaf0079a0… https://security.archlinux.org/CVE-2017-15041

1 0

[arch-security] [ASA-201710-15] go: arbitrary command execution
by Levente Polyak 13 Oct '17

13 Oct '17

Arch Linux Security Advisory ASA-201710-15 ========================================== Severity: High Date : 2017-10-12 CVE-ID : CVE-2017-15041 Package : go Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-442 Summary ======= The package go before version 2:1.9.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2:1.9.1-1. # pacman -Syu "go>=2:1.9.1-1" The problem has been fixed upstream in version 1.9.1. Workaround ========== None. Description =========== Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get". Impact ====== A remote attacker may be able to execute arbitrary commands on a system running "go get" by using a specially prepared repository. References ========== https://github.com/golang/go/issues/22125 https://github.com/golang/tools/commit/ebae2dcdbabadfdb9880a627481eaf0079a0… https://security.archlinux.org/CVE-2017-15041

1 0