- Arch-security - lists.archlinux.org

[arch-security] [ASA-201510-14] ntp: multiple issues
by Christian Rebischke 22 Oct '15

22 Oct '15

Arch Linux Security Advisory ASA-201510-14 ========================================== Severity: Critical Date : 2015-10-22 CVE-ID : CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8.p4-1 is vulnerable to multiple issues including denial of service, memory corruption, directory traversal, memory leaks and authentication bypass. Resolution ========== Upgrade to 4.2.8.p4-1. # pacman -Syu "ntp>=4.2.8.p4-1" The problems have been fixed upstream in version 4.2.8.p4. Workaround ========== None. Description =========== - CVE-2015-7871 (authentication bypass) An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is credited with discovering this vulnerability. [1] - CVE-2015-7855 (denial of service) decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values. This can cause a denial of service. - CVE-2015-7854 (memory corruption) A potential buffer overflow vulnerability exists in the password management functionality of ntp. A specially crafted key file could cause a buffer overflow potentially resulting in memory being modified. An attacker could provide a malicious password to trigger this vulnerability. [2] - CVE-2015-7849 (memory corruption) An exploitable use-after-free vulnerability exists in the password management functionality of the Network Time Protocol. A specially crafted key file could cause a buffer overflow resulting in memory corruption. An attacker could provide a malicious password file to trigger this vulnerability. [3] - CVE-2015-7852 (memory corruption) A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds. [4] - CVE-2015-7853 (memory corruption) A potential buffer overflow vulnerability exists in the refclock of ntpd. An invalid length provided by a hardware reference clock could cause a buffer overflow potentially resulting in memory being modified. A malicious reflock could provide a negative length to trigger this vulnerability. [5] - CVE-2015-7848 (denial of service) When processing a specially crafted private mode packet, an integer overflow can occur leading to out of bounds memory copy operation. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash. [6] - CVE-2015-7850 (denial of service) An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability. [7] - CVE-2015-7851 (directory traversal) A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability. [8] - CVE-2015-7701 (memory leak) Slow memory leak in CRYPTO_ASSOC. - CVE-2015-7702 (denial of service). Incomplete autokey data packet length checks. - CVE-2015-7703 (directory traversal) configuration directives "pidfile" and "driftfile" should only be allowed locally. - CVE-2015-7704 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7705 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7691 (denial of service) Incomplete autokey data packet length checks. - CVE-2015-7692 (denial of service Incomplete autokey data packet length checks. Impact ====== A remote attacker is able to crash the NTP-Server, change the system time, overwrite configuration file or can corrupt the memory. References ========== http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities http://blog.talosintel.com/2015/10/ntpd-vulnerabilities.html http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7691 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7692 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7701 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7702 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7703 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7704 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7705 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7848 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7849 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7850 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7851 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7852 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7853 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7854 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7855 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7871 [1] http://talosintel.com/reports/TALOS-2015-0069/ [2] http://talosintel.com/reports/TALOS-2015-0065/ [3] http://talosintel.com/reports/TALOS-2015-0054/ [4] http://talosintel.com/reports/TALOS-2015-0063/ [5] http://talosintel.com/reports/TALOS-2015-0064/ [6] http://talosintel.com/reports/TALOS-2015-0052/ [7] http://talosintel.com/reports/TALOS-2015-0055/ [8] http://talosintel.com/reports/TALOS-2015-0062/

1 0

[arch-security] [ASA-201510-13] spice: multiple issues
by Remi Gacogne 19 Oct '15

19 Oct '15

Arch Linux Security Advisory ASA-201510-13 ========================================== Severity: High Date : 2015-10-19 CVE-ID : CVE-2015-3247 CVE-2015-5260 CVE-2015-5261 Package : spice Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package spice before version 0.12.6-1 is vulnerable to multiple issues, including denial of service and privilege escalation. Resolution ========== Upgrade to 0.12.6-1. # pacman -Syu "spice>=0.12.6-1" The problem has been fixed upstream in version 0.12.6. Workaround ========== None. Description =========== - CVE-2015-3247 (race condition flaw): A race condition flaw was found in spice's worker_update_monitors_config() function, leading to a heap-based memory corruption. A user in a guest could leverage this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5260 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way spice handled certain QXL commands related to the "surface_id" parameter. A user in a guest could use this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5261 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host. Impact ====== A rogue guest user can cause a denial of service to the host or execute arbitrary command with the privileges of the host QEMU-KVM process. References ========== https://bugs.archlinux.org/task/46738 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3247 https://access.redhat.com/security/cve/CVE-2015-5260 https://access.redhat.com/security/cve/CVE-2015-5261 http://lists.freedesktop.org/archives/spice-devel/2015-October/022168.html

1 0

[arch-security] [ASA-201510-12] flashplugin: arbitrary code execution
by Remi Gacogne 18 Oct '15

18 Oct '15

Arch Linux Security Advisory ASA-201510-12 ========================================== Severity: Critical Date : 2015-10-18 CVE-ID : CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.540-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.540-1. # pacman -Syu "flashplugin>=11.2.202.540-1" The problem has been fixed upstream in version 11.2.202.540. Workaround ========== None. Description =========== Several critical type confusion vulnerabilities (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648) have been identified in Adobe Flash Player 11.2.202.535 and earlier 11.x versions for Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for the CVE-2015-7645 vulnerability is being used in limited, targeted attacks. Impact ====== A remote attacker can execute arbitrary code by supplying a crafted SWF flash file on a website. These vulnerabilities are currently exploited in the wild. References ========== https://helpx.adobe.com/security/products/flash-player/apsa15-05.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7645

1 0

[arch-security] [ASA-201510-11] miniupnpc: arbitrary code execution
by Levente Polyak 18 Oct '15

18 Oct '15

Arch Linux Security Advisory ASA-201510-11 ========================================== Severity: Critical Date : 2015-10-18 CVE-ID : CVE-2015-6031 Package : miniupnpc Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package miniupnpc before version 1.9.20151008-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.9.20151008-1. # pacman -Syu "miniupnpc>=1.9.20151008-1" The problem has been fixed upstream but no release is available. Workaround ========== None. Description =========== An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability. Impact ====== A remote attacker is able to create a specially crafted XML response on a server set up on the local network to execute arbitrary code on the client. References ========== http://talosintel.com/reports/TALOS-2015-0035/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6031 https://bugs.archlinux.org/task/46612

1 0

[arch-security] [ASA-201510-10] firefox: cross-origin restriction bypass
by Remi Gacogne 16 Oct '15

16 Oct '15

Arch Linux Security Advisory ASA-201510-10 ========================================== Severity: High Date : 2015-10-16 CVE-ID : CVE-2015-7184 Package : firefox Type : cross-origin restriction bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 41.0.2-1 is vulnerable to cross-origin restriction bypass. Resolution ========== Upgrade to 41.0.2-1. # pacman -Syu "firefox>=41.0.2-1" The problem has been fixed upstream in version 41.0.2. Workaround ========== None. Description =========== Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue. Impact ====== A remote attacker can bypass the cross-origin resource sharing policy to access sensitive information. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7184

1 0

[arch-security] [ASA-201510-9] mbedtls: arbitrary code execution
by Remi Gacogne 15 Oct '15

15 Oct '15

Arch Linux Security Advisory ASA-201510-9 ========================================= Severity: Critical Date : 2015-10-15 CVE-ID : CVE-2015-5291 Package : mbedtls Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mbedtls before version 2.1.2-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 2.1.2-1. # pacman -Syu "mbedtls>=2.1.2-1" The problem has been fixed upstream in versions 2.1.2, 1.3.14 and 1.2.17. Workaround ========== To be protected against this vulnerability, you need to apply both of the following work-arounds: - Do not use ticket-based session resumption. This can be achieved in two ways: (1) do not attempt to resume a saved session (do not use mbedtls_get_session() / mbedtls_set_session()), or (2) if you want to resume sessions, make sure you're not using tickets by calling ssl_set_session_tickets( SSL_SESSION_TICKETS_DISABLED ) in 1.3.x or mbedtls_ssl_conf_session_tickets( MBEDTLS_SSL_SESSION_TICKETS_DISABLED ) in 2.x. - If you accept hostnames from untrusted parties, validate that they are at most 255 bytes long (limit defined by RFC 1305) before passing them to ssl_set_hostname(). Description =========== When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the session ticket extension and the server name indication (SNI) extension. Starting with PolarSSL 1.3.0 which added support for session tickets, any server the client connects to can send an overlong session ticket which will cause a buffer overflow if and when the client attempts to resume the connection with the server. Clients that disabled session tickets or never attempt to reconnect to a server using a saved session are not vulnerable to this attack vector. Starting with PolarSSL 1.0.0, this overflow could also be triggered by an attacker convincing a client to use an overlong hostname for the SNI extension. The hostname needs to be almost as long at SSL_MAX_CONTENT_LEN, which as 16KB by default, but could be smaller if a custom configuration is used. Clients that do not accept hostnames from untrusted parties are not vulnerable to this attack vector. Impact ====== A malicious server could cause a denial of service or execute arbitrary code on a vulnerable client by sending an overlong session ticket. An attacker could cause a denial of service or execute arbitrary code on a vulnerable client by convincing it to connect to an overlong hostname. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://access.redhat.com/security/cve/CVE-2015-5291

1 0

[arch-security] [ASA-201510-8] chromium: multiple issues
by Remi Gacogne 14 Oct '15

14 Oct '15

Arch Linux Security Advisory ASA-201510-8 ========================================= Severity: High Date : 2015-10-14 CVE-ID : CVE-2015-6755 CVE-2015-6756 CVE-2015-6757 CVE-2015-6758 CVE-2015-6759 CVE-2015-6760 CVE-2015-6761 CVE-2015-6762 CVE-2015-6763 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 46.0.2490.71-1 is vulnerable to multiple issues including but not limited to cross-origin bypass, information leakage and denial of service. Resolution ========== Upgrade to 46.0.2490.71-1. # pacman -Syu "chromium>=46.0.2490.71-1" The problem has been fixed upstream in version 46.0.2490.71. Workaround ========== None. Description =========== - CVE-2015-6755 (cross-origin bypass): Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2015-6756 (use-after-free): Use-after-free in PDFium. - CVE-2015-6757 (use-after-free): Use-after-free in ServiceWorker. Credit to Collin Payne. - CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG. - CVE-2015-6759 (information leakage): Information leakage in LocalStorage. Credit to Muneaki Nishimura (nishimunea). - CVE-2015-6760 (improper error handling): Improper error handling in libANGLE. Credit to lastland.net. - CVE-2015-6761 (memory corruption): Memory corruption in FFMpeg. Credit to Aki Helin of OUSPG and anonymous. - CVE-2015-6762 (cross-origin resource sharing bypass): CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea). - CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass the cross-origin restrictions, get access to sensitive information, cause a denial of service or possibly have unspecified other impact. References ========== http://googlechromereleases.blogspot.fr/2015/10/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2015-6755 https://access.redhat.com/security/cve/CVE-2015-6756 https://access.redhat.com/security/cve/CVE-2015-6757 https://access.redhat.com/security/cve/CVE-2015-6758 https://access.redhat.com/security/cve/CVE-2015-6759 https://access.redhat.com/security/cve/CVE-2015-6760 https://access.redhat.com/security/cve/CVE-2015-6761 https://access.redhat.com/security/cve/CVE-2015-6762 https://access.redhat.com/security/cve/CVE-2015-6763

1 0

[arch-security] [ASA-201510-7] flashplugin: multiple issues
by Levente Polyak 14 Oct '15

14 Oct '15

Arch Linux Security Advisory ASA-201510-7 ========================================= Severity: Critical Date : 2015-10-14 CVE-ID : CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.535-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, same-origin-policy bypass and information disclosure. Resolution ========== Upgrade to 11.2.202.535-1. # pacman -Syu "flashplugin>=11.2.202.535-1" The problems have been fixed upstream in version 11.2.202.535. Workaround ========== None. Description =========== - CVE-2015-5569 (information leak, insufficient hardening) These updates include a defense-in-depth feature in the Flash broker API. - CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7630 CVE-2015-7633 CVE-2015-7634 (arbitrary code execution) These updates resolve memory corruption vulnerabilities that could lead to code execution. - CVE-2015-7628 (same-origin-policy bypass, information disclosure) These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure. - CVE-2015-7629 CVE-2015-7631 CVE-2015-7643 CVE-2015-7644 (arbitrary code execution) These updates resolve use-after-free vulnerabilities that could lead to code execution. - CVE-2015-7632 (arbitrary code execution) These updates resolve a buffer overflow vulnerability that could lead to code execution. Impact ====== A remote attacker is able to execute arbitrary code, bypass the same-origin-policy and disclose sensitive information via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://helpx.adobe.com/security/products/flash-player/apsb15-25.html

1 0

[arch-security] [ASA-201510-6] gdk-pixbuf2: multiple issues
by Levente Polyak 10 Oct '15

10 Oct '15

Arch Linux Security Advisory ASA-201510-6 ========================================= Severity: Medium Date : 2015-10-10 CVE-ID : CVE-2015-7673 CVE-2015-7674 Package : gdk-pixbuf2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gdk-pixbuf2 before version 2.32.1-1 is vulnerable to denial of service and heap buffer overflow. Resolution ========== Upgrade to 2.32.1-1. # pacman -Syu "gdk-pixbuf2>=2.32.1-1" The problems have been fixed upstream in version 2.32.1. Workaround ========== None. Description =========== - CVE-2015-7673 (denial of service) It has been discovered that under certain circumstances while scaling a tga file a heap memory allocation may fail which is later used and leads to a denial of service. - CVE-2015-7673 (heap buffer overflow) It has been discovered that under certain circumstances while scaling a gif file a heap buffer overflow can occur. The cause of this issue was that the integer data type was incompatible with the details of how bitwise shifts were used. Impact ====== A remote attacker is able to use specially crafted tga or gif files to perform a denial of service attack or take advantage of a heap buffer overflow to possibly have other impact. References ========== https://access.redhat.com/security/cve/CVE-2015-7673 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7674 http://seclists.org/oss-sec/2015/q4/18 http://seclists.org/oss-sec/2015/q4/19

1 0

[arch-security] [ASA-201510-5] opensmtpd: multiple issues
by Levente Polyak 08 Oct '15

08 Oct '15

Arch Linux Security Advisory ASA-201510-5 ========================================= Severity: Critical Date : 2015-10-08 CVE-ID : CVE-2015-7687 Package : opensmtpd Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package opensmtpd before version 5.7.3p1-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 5.7.3p1-1. # pacman -Syu "opensmtpd>=5.7.3p1-1" The problems have been fixed upstream in version 5.7.3p1. Workaround ========== None. Description =========== - an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory - multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD - a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user - a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files - a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash from /etc/master.passwd) - a denial-of-service vulnerability that allows remote attackers to fill OpenSMTPD's queue or mailbox hard-disk partition - an out-of-bounds memory read that allows remote attackers to crash OpenSMTPD, or leak information and defeat the ASLR protection - a use-after-free vulnerability that allows remote attackers to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user - fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda - fix remote buffer overflow in unprivileged pony process - reworked offline enqueue to better protect against hardlink attacks Impact ====== A remote attacker is able to execute arbitrary code, crash the process to perform a denial of service attack, read arbitrary memory to disclose information and defeat ASLR or have other unspecified impact via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-7687 https://www.opensmtpd.org/announces/release-5.7.2.txt https://www.opensmtpd.org/announces/release-5.7.3.txt http://seclists.org/oss-sec/2015/q4/17 https://bugs.archlinux.org/task/46605

1 0