Arch Linux Security Advisory ASA-201410-2 ========================================= Severity: Critical Date : 2014-10-02 CVE-ID : CVE-2013-2186 CVE-2014-1869 CVE-2014-3661 CVE-2014-3662 CVE-2014-3663 CVE-2014-3664 CVE-2014-3666 CVE-2014-3667 CVE-2014-3678 CVE-2014-3679 CVE-2014-3680 CVE-2014-3681 Package : jenkins Type : Multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package jenkins before version 1.583-1 is vulnerable to multiple vulnerabilities, including but not limited to: - denial of service ; - information leakage ; - privilege escalation ; - XSS ; - arbitrary file system write ; - remote code execution. Resolution ========== Upgrade to 1.583-1. # pacman -Syu "jenkins>=1.583-1" The problem has been fixed upstream in version 1.583. Workaround ========== None. Description =========== - SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake) This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion. - SECURITY-110/CVE-2014-3662 (User name discovery) Anonymous users can test if the user of a specific name exists or not through login attempts. - SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission) An user with a permission limited to Job/CONFIGURE can exploit this vulnerability to effectively create a new job, which should have been only possible for users with Job/CREATE permission, or to destroy jobs that he/she does not have access otherwise. - SECURITY-131/CVE-2014-3664 (directory traversal attack) Users with Overall/READ permission can access arbitrary files in the file system readable by the Jenkins process, resulting in the exposure of sensitive information, such as encryption keys. - SECURITY-138/CVE-2014-3680 (Password exposure in DOM) If a parameterized job has a default value in a password field, that default value gets exposed to users with Job/READ permission. - SECURITY-143/CVE-2014-3681 (XSS vulnerability in Jenkins core) Reflected cross-site scripting vulnerability in Jenkins core. An attacker can navigate the user to a carefully crafted URL and have the user execute unintended actions. - SECURITY-150/CVE-2014-3666 (remote code execution from CLI) Unauthenticated user can execute arbitrary code on Jenkins master by sending carefully crafted packets over the CLI channel. - SECURITY-155/CVE-2014-3667 (exposure of plugin code) Programs that constitute plugins can be downloaded by anyone with the Overall/READ permission, resulting in the exposure of otherwise sensitive information, such as hard-coded keys in plugins, if any. - SECURITY-159/CVE-2013-2186 (arbitrary file system write) Security vulnerability in commons fileupload allows unauthenticated attacker to upload arbitrary files to Jenkins master. - SECURITY-149/CVE-2014-1869 (XSS vulnerabilities in ZeroClipboard) reflective XSS vulnerability in one of the library dependencies of Jenkins. - SECURITY-113/CVE-2014-3678 (XSS vulnerabilities in monitoring plugin) Monitoring plugin allows an attacker to cause a victim into executing unwanted actions on Jenkins instance. - SECURITY-113/CVE-2014-3679 (hole in access control) Certain pages in monitoring plugin are visible to anonymous users, allowing them to gain information that they are not supposed to. Impact ====== A remote, non-privileged attacker can execute arbitrary code, read and write arbitrary files and trick valid users into doing unwanted actions. References ========== https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-... https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2186 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1869 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3661 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3662 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3663 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3664 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3666 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3667 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3678 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3679 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3680 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3681