- Arch-security - lists.archlinux.org

[arch-security] [ASA-201512-4] nodejs: multiple issues
by Remi Gacogne 05 Dec '15

05 Dec '15

Arch Linux Security Advisory ASA-201512-4 ========================================= Severity: High Date : 2015-12-05 CVE-ID : CVE-2015-6764 CVE-2015-8027 Package : nodejs Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nodejs before version 5.1.1-1 is vulnerable to multiple issues, including but not limited to denial of service. Resolution ========== Upgrade to 5.1.1-1. # pacman -Syu "nodejs>=5.1.1-1" The problem has been fixed upstream in version 0.12.9, 4.2.3 and 5.1.1. Workaround ========== None. Description =========== - CVE-2015-6764 (V8 out-of-bounds access vulnerability): A bug was discovered in V8's implementation of JSON.stringify() that can result in out-of-bounds reads on arrays. The patch was included in this week's update of Chrome Stable. While this bug is high severity for browsers, it is considered lower risk for Node.js users as it requires the execution of third-party JavaScript within an application in order to be exploitable. Node.js users who expose services that process untrusted user-supplied JavaScript are at obvious risk. However, we recommend that all users of impacted versions of Node.js upgrade to the appropriate patched version in order to protect against malicious third-party JavaScript that may be executed within a Node.js process by other means. - CVE-2015-8027 (denial of service): This critical denial of service (DoS) vulnerability impacts all versions of v0.12.x through to v5.x, inclusive. The vulnerability was discovered by Node.js core team member Fedor Indutny and relates to HTTP pipelining. Under certain conditions an HTTP socket may no longer have a parser associated with it but a pipelined request can trigger a pause or resume on the non-existent parser thereby causing an uncaughtException to be thrown. As these conditions can be created by an external attacker and cause a Node.js service to be shut down we consider this a critical vulnerability. It is recommended that users of impacted versions of Node.js exposing HTTP services upgrade to the appropriate patched versions as soon as practical. Impact ====== A remote attacker can shutdown a vulnerable Node.js service, or have unspecified impact via out-of-bounds reads on array. References ========== https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/ https://access.redhat.com/security/cve/CVE-2015-6764 https://access.redhat.com/security/cve/CVE-2015-8027

1 0

[arch-security] strange netstat connections after having opened Firefox
by Elmar Stellnberger 05 Dec '15

05 Dec '15

The following number of connections was returned by netstat -atupn while Firefox was already closed and killall-ed to show that it really had sucessfully closed itself before (It was open only for short mainly in order to reboot my router.): Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 192.168.100.101:50056 5.196.185.225:80 TIME_WAIT - tcp 0 0 192.168.100.101:35860 92.92.207.51:80 TIME_WAIT - tcp 0 0 192.168.100.101:40912 195.154.59.140:80 TIME_WAIT - tcp 0 0 192.168.100.101:58746 178.63.62.19:80 TIME_WAIT - tcp 0 0 192.168.100.101:40482 52.32.86.111:443 TIME_WAIT - tcp 0 0 192.168.100.101:43256 46.4.37.89:80 TIME_WAIT - udp 0 0 192.168.100.101:59824 193.170.62.252:123 ESTABLISHED 328/ntpd: ntp engin udp 0 0 192.168.100.101:40120 80.64.132.152:123 ESTABLISHED 328/ntpd: ntp engin udp 0 0 0.0.0.0:68 0.0.0.0:* 304/dhcpcd There should not be any unnamed daemon opening up such connections under Arch Linux when netstat -atupn is run as root, right? (At least I have installed none; I already know from previous netstats that Arch is very strict with its default configuration in this regard.) What has made me look was a 100% CPU load indicated by my CPU fan but actually not by the KDE GUI (sorry, forgot to run top and do similar things). The 100% 'fan' load remained after unplugging the cable; as well as the connections shown by netstat. I would believe that it is not an attack by an US-service because usually with similar incidents no such connection list is returned by netstat. Perhaps anyone can be helpful with that? Elmar

9 16

[arch-security] [ASA-201512-3] python-django, python2-django: information leakage
by Remi Gacogne 05 Dec '15

05 Dec '15

Arch Linux Security Advisory ASA-201512-3 ========================================= Severity: Medium Date : 2015-12-05 CVE-ID : CVE-2015-8213 Package : python-django, python2-django Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages python-django and python2-django before version 1.8.7-1 are vulnerable to information leakage. Resolution ========== Upgrade to 1.8.7-1. # pacman -Syu "python-django>=1.8.7-1" # pacman -Syu "python2-django>=1.8.7-1" The problem has been fixed upstream in version 1.8.7 and 1.7.11. Workaround ========== None. Description =========== If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y". To remedy this, the underlying function used by the date template filter, django.utils.formats.get_format(), now only allows accessing the date/time formatting settings. Impact ====== A remote attacker might be able to access sensitive information from a vulnerable application. References ========== https://access.redhat.com/security/cve/CVE-2015-8213 https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/

1 0

[arch-security] [ASA-201512-2] openssl lib32-openssl: multiple issues
by Christian Rebischke 05 Dec '15

05 Dec '15

Arch Linux Security Advisory ASA-201512-2 ========================================= Severity: High Date : 2015-12-05 CVE-ID : CVE-2015-3193 CVE-2015-3194 CVE-2015-3195 CVE-2015-3196 CVE-2015-1794 Package : openssl lib32-openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages openssl and lib32-openssl before version 1.0.2.e-1 are vulnerable to multiple issues including memory leaks, denial of service, double free. If you use DHE there is a possibility that organizations with enough system resources can guess your private key. Resolution ========== Upgrade to 1.0.2.e-1. # pacman -Syu "openssl>=1.0.2.e-1" If you use lib32-openssl it is strongly recommended to upgrade this package as well. # pacman -Syu "lib32-openssl>=1.0.2.e-1" The problems have been fixed upstream in version 1.0.2.e. Workaround ========== None. Description =========== - CVE-2015-3193 (insecure private key in connection with DHE) There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites.[1] - CVE-2015-3194 (denial of service) The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and absent mask generation function parameter. Since these routines are used to verify certificate signature algorithms this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication.[2] - CVE-2015-3195 (memory leaks) When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS#7 and CMS routines so any application which reads PKCS#7 or CMS data from untrusted sources is affected. SSL/TLS is not affected.[3] - CVE-2015-3196 (double free) If PSK identity hints are received by a multi-threaded client then the values are wrongly updated in the parent SSL_CTX structure. This can result in a race condition potentially leading to a double free of the identify hint data.[4] - CVE-2015-1794 (denial of service) If a client receives a ServerKeyExchange for an anonymous DH ciphersuite with the value of p set to 0 then a seg fault can occur leading to a possible denial of service attack.[5] Impact ====== A remote attacker is possible to guess the private key (only when DHE is used) with enough resources (e.g NSA/GHCQ), crash openssl (denial of service) and make use of memory leaks.[6] References ========== [1] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3193 [2] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3194 [3] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3195 [4] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3196 [5] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1794 [6] https://www.openssl.org/news/secadv/20151203.txt

1 0

Re: [arch-security] mailinglist time issues (at discussion 'strange netstat connections after having opened Firefox')
by Sebastian 05 Dec '15

05 Dec '15

Hey there, On 2015-12-04 22:52, respiranto wrote: > On 12/05/2015 12:26 AM, Elmar Stellnberger wrote: >> [...] > > Is it possible, that your mailserver has some time issues? > On my machine, it is currently 2015-12-04, 21:52:05 UTC. > My timezone is UTC+1, so 2015-12-05, 12:26 is definitely in the future. > There are two other such mails: > - today, 21:58 UTC > - today, 22:46 UTC > > Or is my mailserver or client somehow responsible for this strange > time discrepancy? > It is shown by both Icedove and Mutt. Same for me. Client is Roundcube Webmail. The mails are out of order and I guess the time is, too (though I didn't look out for "future" mails). I'm also in UTC+1. Greetings, Sebastian -- A great many of today's security technologies are "secure" only because no-one has ever bothered attacking them. -- Peter Gutmann

1 0

Re: [arch-security] strange netstat connections after having opened Firefox
by cspence＠unomaha.edu 04 Dec '15

04 Dec '15

I may also suggest leveraging auditd to track what processes are attempting to establish network connections if you want to specifically pin down the source of all your closed connections. Note that this will eat up a lot of log space quickly if you use it for more than a reasonable span of time. At the very least, this will help you determine what network activity is part of the expected baseline if hardening and monitoring is your goal. > > Thanks for the provided material and info, Jonathan; > > Unfortunately I can not prevent Firefox entirely from connecting to > apparently random web addresses once I open it; not even with the > settings (malware, phishing) you have recommended me to try; not even > with disabling all addons. Three servers that were contacted while/upon > an about:blank invocation:

1 0

[arch-security] [ASA-201512-1] chromium: multiple issues
by Remi Gacogne 02 Dec '15

02 Dec '15

Arch Linux Security Advisory ASA-201512-1 ========================================= Severity: Critical Date : 2015-12-02 CVE-ID : CVE-2015-6764 CVE-2015-6765 CVE-2015-6766 CVE-2015-6767 CVE-2015-6768 CVE-2015-6769 CVE-2015-6770 CVE-2015-6771 CVE-2015-6772 CVE-2015-6773 CVE-2015-6774 CVE-2015-6775 CVE-2015-6776 CVE-2015-6777 CVE-2015-6778 CVE-2015-6779 CVE-2015-6780 CVE-2015-6781 CVE-2015-6782 CVE-2015-6784 CVE-2015-6785 CVE-2015-6786 CVE-2015-6787 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 47.0.2526.73-1 is vulnerable to multiple issues including but not limited to various memory corruption, cross-origin bypass and scheme bypass. Resolution ========== Upgrade to 47.0.2526.73-1. # pacman -Syu "chromium>=47.0.2526.73-1" The problem has been fixed upstream in version 47.0.2526.73. Workaround ========== None. Description =========== - CVE-2015-6764: Out of bounds access in v8. Credit to Guang Gong of Qihoo 360 via pwn2own. - CVE-2015-6765, CVE-2015-6766, CVE-2015-6767: Use-after-free in AppCache. - CVE-2015-6768, CVE-2015-6770, CVE-2015-6772: Cross-origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2015-6769: Cross-origin bypass in core. Credit to Mariusz Mlynski. - CVE-2015-6771: Out of bounds access in v8. - CVE-2015-6773: Out of bounds access in Skia. Credit to cloudfuzzer. - CVE-2015-6774: Use-after-free in Extensions. - CVE-2015-6775: Type confusion in PDFium. Credit to Atte Kettunen of OUSPG. - CVE-2015-6776: Out of bounds access in PDFium. Credit to Hanno Böck. - CVE-2015-6777: Use-after-free in DOM. Credit to Long Liu of Qihoo 360Vulcan Team. - CVE-2015-6778: Out of bounds access in PDFium. Credit to Karl Skomski. - CVE-2015-6779: Scheme bypass in PDFium. Credit to Til Jasper Ullrich. - CVE-2015-6780: Use-after-free in Infobars. Credit to Khalil Zhani. - CVE-2015-6781: Integer overflow in Sfntly. Credit to miaubiz. - CVE-2015-6782: Content spoofing in Omnibox. Credit to Luan Herrera. - CVE-2015-6784: Escaping issue in saved pages. Credit to Inti De Ceukelaire. - CVE-2015-6785: Wildcard matching issue in CSP. Credit to Michael Ficarra / Shape Security. - CVE-2015-6786: Scheme bypass in CSP. Credit to Michael Ficarra / Shape Security. - CVE-2015-6787: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker might be able to bypass CSP and cross-origin policies, or execute arbitrary code on the affected host. References ========== http://googlechromereleases.blogspot.fr/2015/12/stable-channel-update.html

1 0

[arch-security] [ASA-201511-11] jenkins: multiple issues
by Levente Polyak 18 Nov '15

18 Nov '15

Arch Linux Security Advisory ASA-201511-11 ========================================== Severity: Critical Date : 2015-11-18 CVE-ID : CVE-2015-5317 CVE-2015-5318 CVE-2015-5319 CVE-2015-5320 CVE-2015-5321 CVE-2015-5322 CVE-2015-5323 CVE-2015-5324 CVE-2015-5325 CVE-2015-5326 CVE-2015-8103 Package : jenkins Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jenkins before version 1.638-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, information leakage, cross-side request forgery, XML external entity injection, access restriction bypass, cross-side scripting and directory traversal. Resolution ========== Upgrade to 1.638-1. # pacman -Syu "jenkins>=1.638-1" The problems have been fixed upstream in version 1.638. Workaround ========== None. Description =========== - CVE-2015-5317 (information leakage) The Jenkins UI allowed users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages if those shared file fingerprints with fingerprinted files in accessible jobs. - CVE-2015-5318 (cross-side request forgery) The salt used to generate the CSRF protection tokens was a publicly accessible value, allowing malicious users to circumvent CSRF protection by generating the correct token. - CVE-2015-5319 (XML external entity injection) When creating a job using the create-job CLI command, external entities are not discarded (nor processed). If these job configurations are processed by another user with an XML-aware tool (e.g. using get-job/update-job), information from that user's computer may be disclosed to Jenkins and the attacker. - CVE-2015-5320 (access restriction bypass) JNLP slave connections did not verify that the correct secret was supplied, which allowed malicious users to connect their own machines as slaves to Jenkins knowing only the name of the slave. This enables attackers to take over Jenkins (unless the slave-to-master security subsystem is enabled) or gain access to private data like keys and source code. - CVE-2015-5321 (information leakage) The CLI command overview and help pages in Jenkins were accessible without Overall/Read permission, resulting in disclosure of the names of configured slaves (and contents of other sidepanel widgets, if present) to unauthorized users. - CVE-2015-5322 (directory traversal) Access to the /jnlpJars/ URL was not limited to the specific JAR files users needed to access, allowing browsing directories and downloading other files in the Jenkins servlet resources, such as web.xml. - CVE-2015-5323 (access restriction bypass) API tokens of other users were exposed to admins by default. On instances that don't implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user's credentials. - CVE-2015-5324 (information leakage) The /queue/api URL could return information about items not accessible to the current user (such as parameter names and values, build names, project descriptions). - CVE-2015-5325 (access restriction bypass) Slaves connecting via JNLP were not subject to the optional slave-to-master access control documented at http://jenkins-ci.org/security-144 (CVE-2014-3665). - CVE-2015-5326 (cross-side scripting) Users with the permission to take slave nodes offline can enter arbitrary HTML that gets shown unescaped to users visiting the slave overview page. - CVE-2015-8103 (arbitrary code execution) Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master. Impact ====== A remote attacker is able to execution arbitrary code, disclose sensitive information, bypass the cross-side request forgery protection, perform XML external entity injection, bypass multiple access restrictions, perform a cross-side scripting attack and make use of a directory traversal issue to download arbitrary files. References ========== https://access.redhat.com/security/cve/CVE-2015-5317 https://access.redhat.com/security/cve/CVE-2015-5318 https://access.redhat.com/security/cve/CVE-2015-5319 https://access.redhat.com/security/cve/CVE-2015-5320 https://access.redhat.com/security/cve/CVE-2015-5321 https://access.redhat.com/security/cve/CVE-2015-5322 https://access.redhat.com/security/cve/CVE-2015-5323 https://access.redhat.com/security/cve/CVE-2015-5324 https://access.redhat.com/security/cve/CVE-2015-5325 https://access.redhat.com/security/cve/CVE-2015-5326 https://access.redhat.com/security/cve/CVE-2015-8103 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015…

1 0

[arch-security] [ASA-201511-10] lib32-libpng: multiple issues
by Levente Polyak 17 Nov '15

17 Nov '15

Arch Linux Security Advisory ASA-201511-10 ========================================== Severity: High Date : 2015-11-17 CVE-ID : CVE-2015-7981 CVE-2015-8126 Package : lib32-libpng Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-libpng before version 1.6.19-1 is vulnerable to denial-of-service and arbitrary code execution. Resolution ========== Upgrade to 1.6.19-1. # pacman -Syu "lib32-libpng>=1.6.19-1" The problems have been fixed upstream in version 1.6.19. Workaround ========== None. Description =========== - CVE-2015-7981 (out-of-bounds read) This is an array indexing error, which can lead to an out-of-bounds read of a static buffer. The result is now unsigned (no longer negative, but now a huge positive number). - CVE-2015-8126 (arbitrary code execution) Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8. Impact ====== A remote attacker is able to create specially crafted png files that, when opened or processed, may lead to denial-of-service or possibly arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-7981 https://access.redhat.com/security/cve/CVE-2015-8126 http://seclists.org/oss-sec/2015/q4/161 http://seclists.org/oss-sec/2015/q4/264 https://bugs.archlinux.org/task/47069

1 0

[arch-security] [ASA-201511-9] libpng: multiple issues
by Levente Polyak 17 Nov '15

17 Nov '15

Arch Linux Security Advisory ASA-201511-9 ========================================= Severity: High Date : 2015-11-17 CVE-ID : CVE-2015-7981 CVE-2015-8126 Package : libpng Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libpng before version 1.6.19-1 is vulnerable to denial-of-service and arbitrary code execution. Resolution ========== Upgrade to 1.6.19-1. # pacman -Syu "libpng>=1.6.19-1" The problems have been fixed upstream in version 1.6.19. Workaround ========== None. Description =========== - CVE-2015-7981 (out-of-bounds read) This is an array indexing error, which can lead to an out-of-bounds read of a static buffer. The result is now unsigned (no longer negative, but now a huge positive number). - CVE-2015-8126 (arbitrary code execution) Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8. Impact ====== A remote attacker is able to create specially crafted png files that, when opened or processed, may lead to denial-of-service or possibly arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-7981 https://access.redhat.com/security/cve/CVE-2015-8126 http://seclists.org/oss-sec/2015/q4/161 http://seclists.org/oss-sec/2015/q4/264 https://bugs.archlinux.org/task/47069

1 0