- Arch-security - lists.archlinux.org

[arch-security] [ASA-201602-7] libbsd: denial of service
by Christian Rebischke 04 Feb '16

04 Feb '16

Arch Linux Security Advisory ASA-201602-7 ========================================== Severity: Low Date : 2016-02-04 CVE-ID : CVE-2016-2090 Package : libbsd Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libbsd before version 0.8.2-1 is vulnerable to denial of service due to a buffer overflow in the "fgetwln"-function. Resolution ========== Upgrade to 0.8.2-1. # pacman -Syu "libbsd>=0.8.2-1" The problem has been fixed upstream in version 0.8.2. Workaround ========== None. Description =========== - CVE-2016-2090 (buffer overflow) libbsd 0.8.1 and earlier contains a buffer overflow in the function fgetwln(). An "if" checks if it is necessary to reallocate memory in the target buffer. However this check is off by one, therefore an out of bounds write happens. Impact ====== A local attacker might be able to crash the application. References ========== https://access.redhat.com/security/cve/CVE-2016-2090 https://bugs.freedesktop.org/show_bug.cgi?id=93881 http://article.gmane.org/gmane.comp.security.oss.general/18715 https://blog.fuzzing-project.org/36-Heap-buffer-overflow-in-fgetwln-functio…

1 0

[arch-security] [ASA-201602-6] lib32-nettle: improper cryptographic calculations
by Levente Polyak 03 Feb '16

03 Feb '16

Arch Linux Security Advisory ASA-201602-6 ========================================= Severity: Medium Date : 2016-02-03 CVE-ID : CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 Package : lib32-nettle Type : improper cryptographic calculations Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-nettle before version 3.2-1 is vulnerable to improper cryptographic calculations with unspecified impact. Resolution ========== Upgrade to 3.2-1. # pacman -Syu "lib32-nettle>=3.2-1" The problems have been fixed upstream in version 3.2-1. Workaround ========== None. Description =========== - CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 (improper cryptographic calculations) It has been discovered that multiple carry propagation bugs are producing wrong results in calculations. They affect the NIST P-256 and P-384 curves. The P-256 bug is in the C code and affects multiple architectures. The P-384 bug is in the assembly code and only affects 64 bit x86. The computation compiles a certain curve point with 1, which should not change the coordinates, however it does. Impact ====== The impact is currently unclear, but miscalculations in cryptographic functions are classified as security issues. References ========== https://access.redhat.com/security/cve/CVE-2015-8803 https://access.redhat.com/security/cve/CVE-2015-8804 https://access.redhat.com/security/cve/CVE-2015-8805 https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scala… https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html

1 0

[arch-security] [ASA-201602-5] nettle: improper cryptographic calculations
by Levente Polyak 03 Feb '16

03 Feb '16

Arch Linux Security Advisory ASA-201602-5 ========================================= Severity: Medium Date : 2016-02-03 CVE-ID : CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 Package : nettle Type : improper cryptographic calculations Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nettle before version 3.2-1 is vulnerable to improper cryptographic calculations with unspecified impact. Resolution ========== Upgrade to 3.2-1. # pacman -Syu "nettle>=3.2-1" The problems have been fixed upstream in version 3.2-1. Workaround ========== None. Description =========== - CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 (improper cryptographic calculations) It has been discovered that multiple carry propagation bugs are producing wrong results in calculations. They affect the NIST P-256 and P-384 curves. The P-256 bug is in the C code and affects multiple architectures. The P-384 bug is in the assembly code and only affects 64 bit x86. The computation compiles a certain curve point with 1, which should not change the coordinates, however it does. Impact ====== The impact is currently unclear, but miscalculations in cryptographic functions are classified as security issues. References ========== https://access.redhat.com/security/cve/CVE-2015-8803 https://access.redhat.com/security/cve/CVE-2015-8804 https://access.redhat.com/security/cve/CVE-2015-8805 https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scala… https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html

1 0

[arch-security] [ASA-201602-4] lib32-curl: authentication bypass
by Levente Polyak 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-4 ========================================= Severity: Low Date : 2016-02-02 CVE-ID : CVE-2016-0755 Package : lib32-curl Type : authentication bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-curl before version 7.47.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 7.47.0-1. # pacman -Syu "lib32-curl>=7.47.0-1" The problem has been fixed upstream in version 7.47.0. Workaround ========== None. Description =========== A vulnerability was found in a way libcurl uses NTLM-authenticated proxy connections. Libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. Since NTLM-based authentication is connection oriented instead of request oriented as other HTTP based authentication, it is important that only connections that have been authenticated with the correct username + password are reused. This was done properly for server connections already, but libcurl failed to do it properly for proxy connections using NTLM, which might allow remote attackers to authenticate as other users via a request. Impact ====== A remote attacker is able to authenticate as other users via a request without providing any NTLM credentials. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0755 http://curl.haxx.se/docs/adv_20160127A.html

1 0

[arch-security] [ASA-201602-3] curl: authentication bypass
by Levente Polyak 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-3 ========================================= Severity: Low Date : 2016-02-02 CVE-ID : CVE-2016-0755 Package : curl Type : authentication bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.47.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 7.47.0-1. # pacman -Syu "curl>=7.47.0-1" The problem has been fixed upstream in version 7.47.0. Workaround ========== None. Description =========== A vulnerability was found in a way libcurl uses NTLM-authenticated proxy connections. Libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. Since NTLM-based authentication is connection oriented instead of request oriented as other HTTP based authentication, it is important that only connections that have been authenticated with the correct username + password are reused. This was done properly for server connections already, but libcurl failed to do it properly for proxy connections using NTLM, which might allow remote attackers to authenticate as other users via a request. Impact ====== A remote attacker is able to authenticate as other users via a request without providing any NTLM credentials. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0755 http://curl.haxx.se/docs/adv_20160127A.html

1 0

[arch-security] [ASA-201602-2] python2-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-2 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python2-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python2-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201602-1] python2-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-1 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python2-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python2-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201602-1] python-django: permission bypass
by Jelle van der Waa 02 Feb '16

02 Feb '16

Arch Linux Security Advisory ASA-201602-1 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048

1 0

[arch-security] [ASA-201601-33] lib32-openssl: man-in-the-middle
by Levente Polyak 29 Jan '16

29 Jan '16

Arch Linux Security Advisory ASA-201601-33 ========================================== Severity: High Date : 2016-01-29 CVE-ID : CVE-2015-3197 CVE-2015-4000 CVE-2016-0701 Package : lib32-openssl Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-openssl before version 1.0.2.f-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1.0.2.f-1. # pacman -Syu "lib32-openssl>=1.0.2.f-1" The problems have been fixed upstream in version 1.0.2.f. Workaround ========== None. Description =========== - CVE-2015-3197 (man-in-the-middle) A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. - CVE-2015-4000 (man-in-the-middle) A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic. - CVE-2016-0701 (man-in-the-middle) It was found that OpenSSL used weak Diffie-Hellman parameters based on unsafe primes, which were generated and stored in X9.42-style parameter files. An attacker who could force the peer to perform multiple handshakes using the same private DH component could use this flaw to conduct man-in-the-middle attacks on the SSL/TLS connection. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-3197 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2016-0701 https://openssl.org/news/secadv/20160128.txt

1 0

[arch-security] [ASA-201601-32] openssl: man-in-the-middle
by Levente Polyak 29 Jan '16

29 Jan '16

Arch Linux Security Advisory ASA-201601-32 ========================================== Severity: High Date : 2016-01-29 CVE-ID : CVE-2015-3197 CVE-2015-4000 CVE-2016-0701 Package : openssl Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.f-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1.0.2.f-1. # pacman -Syu "openssl>=1.0.2.f-1" The problems have been fixed upstream in version 1.0.2.f. Workaround ========== None. Description =========== - CVE-2015-3197 (man-in-the-middle) A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. - CVE-2015-4000 (man-in-the-middle) A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic. - CVE-2016-0701 (man-in-the-middle) It was found that OpenSSL used weak Diffie-Hellman parameters based on unsafe primes, which were generated and stored in X9.42-style parameter files. An attacker who could force the peer to perform multiple handshakes using the same private DH component could use this flaw to conduct man-in-the-middle attacks on the SSL/TLS connection. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-3197 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2016-0701 https://openssl.org/news/secadv/20160128.txt

1 0