- Arch-security - lists.archlinux.org

[arch-security] [ASA-201503-5] chromium: multiple issues
by Remi Gacogne 05 Mar '15

05 Mar '15

Arch Linux Security Advisory ASA-201503-5 ========================================= Severity: Critical Date : 2015-03-05 CVE-ID : CVE-2015-1212 CVE-2015-1213 CVE-2015-1214 CVE-2015-1215 CVE-2015-1216 CVE-2015-1217 CVE-2015-1218 CVE-2015-1219 CVE-2015-1220 CVE-2015-1221 CVE-2015-1222 CVE-2015-1223 CVE-2015-1224 CVE-2015-1225 CVE-2015-1226 CVE-2015-1227 CVE-2015-1228 CVE-2015-1229 CVE-2015-1230 CVE-2015-1231 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 41.0.2272.76-1 is vulnerable to multiple issues. While the exact impact has not been disclosed by the vendor, most issues has been classified as having a high or critical impact. Resolution ========== Upgrade to 41.0.2272.76-1. # pacman -Syu "chromium>=41.0.2272.76-1" The problem has been fixed upstream in version 41.0.2272.76. Workaround ========== None. Description =========== - CVE-2015-1212: Out-of-bounds write in media. - CVE-2015-1213, CVE-2015-1214, CVE-2015-1215: Out-of-bounds write in skia filters. - CVE-2015-1216: Use-after-free in v8 bindings. - CVE-2015-1217: Type confusion in v8 bindings. - CVE-2015-1218: Use-after-free in dom. - CVE-2015-1219: Integer overflow in webgl. - CVE-2015-1220: Use-after-free in gif decoder. - CVE-2015-1221: Use-after-free in web databases. - CVE-2015-1222: Use-after-free in service workers. - CVE-2015-1223: Use-after-free in dom. - CVE-2015-1224: Out-of-bounds read in vpxdecoder. - CVE-2015-1225: Out-of-bounds read in pdfium. - CVE-2015-1226: Validation issue in debugger. - CVE-2015-1227: Uninitialized value in blink. - CVE-2015-1228: Uninitialized value in rendering. - CVE-2015-1229: Cookie injection via proxies. - CVE-2015-1230: Type confusion in v8. - CVE-2015-1231: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== There isn't enough information disclosed by the vendor at this moment. At least one issue has been classified as critical by the vendor (https://code.google.com/p/chromium/issues/detail?id=460145) so arbitrary remote code execution can not be ruled out. References ========== http://googlechromereleases.blogspot.fr/2015/03/stable-channel-update.html http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1212 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1213 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1214 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1215 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1216 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1217 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1218 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1219 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1220 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1221 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1222 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1223 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1224 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1225 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1226 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1227 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1228 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1229 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1230 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1231

1 0

[arch-security] [ASA-201503-4] grep: denial of service
by Levente Polyak 05 Mar '15

05 Mar '15

Arch Linux Security Advisory ASA-201503-4 ========================================= Severity: Low Date : 2015-03-05 CVE-ID : CVE-2015-1345 Package : grep Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package grep before version 2.21-2 is vulnerable to denial of service via heap buffer out-of-bounds read. Resolution ========== Upgrade to 2.21-2. # pacman -Syu "grep>=2.21-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The bmexec_trans function in kwset.c allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option. grep's read buffer is often filled to its full size, except when reading the final buffer of a file. In that case, the number of bytes read may be far less than the size of the buffer. However, for certain unusual pattern/text combinations, grep -F would mistakenly examine bytes in that uninitialized region of memory when searching for a match. With carefully chosen inputs, one can cause grep -F to read beyond the end of that buffer altogether. This problem arose via commit v2.18-90-g73893ff with the introduction of a more efficient heuristic using what is now the memchr_kwset function. The use of that function in bmexec_trans could leave TP much larger than EP, and the subsequent call to bm_delta2_search would mistakenly access beyond end of the main input read buffer. Impact ====== A local attacker is able to use specially crafted input when using the -F option to cause a heap buffer out-of-bounds read leading to denial of service. References ========== http://seclists.org/oss-sec/2015/q1/179 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1345 https://bugs.archlinux.org/task/44017

1 0

[arch-security] [ASA-201503-3] lib32-elfutils: directory traversal
by Levente Polyak 02 Mar '15

02 Mar '15

Arch Linux Security Advisory ASA-201503-3 ========================================= Severity: Medium Date : 2015-03-02 CVE-ID : CVE-2014-9447 Package : lib32-elfutils Type : directory traversal Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-elfutils before version 0.161-2 is vulnerable to directory traversal. Resolution ========== Upgrade to 0.161-2. # pacman -Syu "lib32-elfutils>=0.161-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program. Impact ====== A remote attacker is able to use a specially crafted archive to write to arbitrary files to the root directory. References ========== http://www.openwall.com/lists/oss-security/2014/12/29/2 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9447 https://bugs.archlinux.org/task/44020

1 0

[arch-security] [ASA-201503-2] elfutils: directory traversal
by Levente Polyak 02 Mar '15

02 Mar '15

Arch Linux Security Advisory ASA-201503-2 ========================================= Severity: Medium Date : 2015-03-02 CVE-ID : CVE-2014-9447 Package : elfutils Type : directory traversal Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package elfutils before version 0.161-3 is vulnerable to directory traversal. Resolution ========== Upgrade to 0.161-3. # pacman -Syu "elfutils>=0.161-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program. Impact ====== A remote attacker is able to use a specially crafted archive to write to arbitrary files to the root directory. References ========== http://www.openwall.com/lists/oss-security/2014/12/29/2 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9447 https://bugs.archlinux.org/task/44019

1 0

[arch-security] [ASA-201503-1] putty: information disclosure
by Levente Polyak 02 Mar '15

02 Mar '15

Arch Linux Security Advisory ASA-201503-1 ========================================= Severity: Medium Date : 2015-03-02 CVE-ID : CVE-2015-2157 Package : putty Type : information disclosure Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package putty before version 0.64-1 is vulnerable to information disclosure of SSH-2 private key information. Resolution ========== Upgrade to 0.64-1. # pacman -Syu "putty>=0.64-1" The problem has been fixed upstream in version 0.64. Workaround ========== None. Description =========== When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys. After loading a private key from a disk file, PuTTY mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created. This applies to SSH-2 private keys only. It affects all tools in the PuTTY suite which load or save private keys: PuTTY, Plink, PSCP, PSFTP, Pageant and PuTTYgen. If any of those programs loads a private key directly (rather than getting a signature from an SSH agent such as Pageant) then they will have left information equivalent to the private key in memory for their entire run. Impact ====== A local attacker is able to retrieve SSH-2 private key information from memory after loading and saving key files to disk as a result of inappropriate wipe. References ========== http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2157

1 0

[arch-security] [ASA-201503-1] krb5: information disclosure
by Levente Polyak 02 Mar '15

02 Mar '15

Arch Linux Security Advisory ASA-201503-1 ========================================= Severity: Medium Date : 2015-03-02 CVE-ID : CVE-2015-2157 Package : putty Type : information disclosure Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package putty before version 0.64-1 is vulnerable to information disclosure of SSH-2 private key information. Resolution ========== Upgrade to 0.64-1. # pacman -Syu "putty>=0.64-1" The problem has been fixed upstream in version 0.64. Workaround ========== None. Description =========== When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys. After loading a private key from a disk file, PuTTY mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created. This applies to SSH-2 private keys only. It affects all tools in the PuTTY suite which load or save private keys: PuTTY, Plink, PSCP, PSFTP, Pageant and PuTTYgen. If any of those programs loads a private key directly (rather than getting a signature from an SSH agent such as Pageant) then they will have left information equivalent to the private key in memory for their entire run. Impact ====== A local attacker is able to retrieve SSH-2 private key information from memory after loading and saving key files to disk as a result of inappropriate wipe. References ========== http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2157

1 1

[arch-security] [ASA-201502-15] thunderbird: multiple issues
by Remi Gacogne 25 Feb '15

25 Feb '15

Arch Linux Security Advisory ASA-201502-15 ========================================== Severity: High Date : 2015-02-25 CVE-ID : CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0835 CVE-2015-0836 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 31.5.0-1 is vulnerable to multiple issues including information leak and remote code execution when used as a web browser. Resolution ========== Upgrade to 31.5.0-1. # pacman -Syu "thunderbird>=31.5.0-1" The problem has been fixed upstream in version 31.5.0. Workaround ========== In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts. Description =========== - CVE-2015-0822 (information leak): Security researcher Armin Razmdjou reported that a user readable file in a known local path could be uploaded to a malicious site. This was done by manipulating the autocomplete feature in a form and user interaction with it. While the local file is not visibly uploaded through the form, its contents are made available through the Document Object Model (DOM) to script content on the attacking page, leading to information disclosure. - CVE-2015-0827 (out-of-bounds read and write, possibly leading to remote code execution) Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to report an out-of-bounds read and an out-of-bounds write when rendering an improperly formatted SVG graphic. This could potentially allow the attacker to read uninitialized memory. - CVE-2015-0831 (use-after-free, possibily leading to remote code execution) Security researcher Paul Bandha used the used the Address Sanitizer tool to discover a use-after-free vulnerability when running specific web content with IndexedDB to create an index. This leads to a potentially exploitable crash. - CVE-2015-0835, CVE-2015-0836 (remote code execution): Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Impact ====== A remote attacker may be able to access sensitive information or execute arbitrary code References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0822 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0827 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0831 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0835 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0836

1 0

[arch-security] [ASA-201502-14] firefox: multiple issues
by Remi Gacogne 25 Feb '15

25 Feb '15

Arch Linux Security Advisory ASA-201502-14 ========================================== Severity: Critical Date : 2015-02-25 CVE-ID : CVE-2015-0819 CVE-2015-0821 CVE-2015-0822 CVE-2015-0823 CVE-2015-0824 CVE-2015-0825 CVE-2015-0826 CVE-2015-0827 CVE-2015-0829 CVE-2015-0830 CVE-2015-0831 CVE-2015-0832 CVE-2015-0834 CVE-2015-0835 CVE-2015-0836 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 36.0-1 is vulnerable to multiple issues, including denial of service, information leak and remote code execution. Resolution ========== Upgrade to 36.0-1. # pacman -Syu "firefox>=36.0-1" The problem has been fixed upstream in version 36.0. Workaround ========== None. Description =========== - CVE-2015-0819 (tab spoofing): Mozilla developer Matthew Noorenberghe reported that whitelisted Mozilla domains could make UITour API calls while the UI Tour pages for Firefox are present in background tabs. If one of these Mozilla domains was compromised and open in another tab, an attacker could then use that tab to engage in spoofing and clickjacking in any foreground tab. - CVE-2015-0821: Security researcher Armin Razmdjou reported that opening hyperlinks on a page with the mouse and specific keyboard key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. This could also allow for the opening of local files or resources from a known location to be opened with local privileges, bypassing security protections. - CVE-2015-0822 (information leak): Security researcher Armin Razmdjou reported that a user readable file in a known local path could be uploaded to a malicious site. This was done by manipulating the autocomplete feature in a form and user interaction with it. While the local file is not visibly uploaded through the form, its contents are made available through the Document Object Model (DOM) to script content on the attacking page, leading to information disclosure. - CVE-2015-0823 (use-after-free): Using the Address Sanitizer tool, security researcher Atte Kettunen found a problem with OpenType Sanitiser (OTS) that resulted in a use-after-free while expanding macros in some circumstances. This use-after-free was only used for information displayed in the developer console and was not exploitable. - CVE-2015-0824 (denial of service): Security researcher Atte Kettunen used the Address Sanitizer tool to discover a crash while drawing images through the Cairo graphics library while using the DrawTarget function. This can result in a segmentation fault due to zero-ing out of memory outside the bounds of the image. - CVE-2015-0825 (information leak): Security researcher Atte Kettunen used the Address Sanitizer tool to discover a buffer underflow during audio playback of a badly formatted MP3 audio files. Through memory allocation manipulation it may be possible to incorporate parts of Firefox memory into an MP3 stream accessible to scripts on the page. - CVE-2015-0826 (out-of-bounds read possibly leading to remote code execution): Security researcher Atte Kettunen used the Address Sanitizer tool to discover an out-of-bounds read during the application of restyling and reflowing changes of web content using CSS. This results in a potentially exploitable crash. - CVE-2015-0827 (out-of-bounds read and write, possibly leading to remote code execution) Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to report an out-of-bounds read and an out-of-bounds write when rendering an improperly formatted SVG graphic. This could potentially allow the attacker to read uninitialized memory. - CVE-2015-0829 (buffer overflow possibily leading to remote code execution) Security researcher Pantrombka reported a buffer overflow in the libstagefright library during video playback when certain invalid MP4 video files led to the allocation of a buffer that was too small for the content. This led to a potentially exploitable crash. - CVE-2015-0830 (denial of service) Security researcher Daniele Di Proietto discovered that when WebGL content crafted in a specific manner wrote strings, it would cause a crash when this content was run. - CVE-2015-0831 (use-after-free, possibily leading to remote code execution) Security researcher Paul Bandha used the used the Address Sanitizer tool to discover a use-after-free vulnerability when running specific web content with IndexedDB to create an index. This leads to a potentially exploitable crash. - CVE-2015-0832 (HPKP and HSTS bypass): Security researcher Muneaki Nishimura reported that when certificate pinning is set to "strict" mode, a period ('.') appended to a hostname in the address of a site allowed the bypass key pinning (HPKP) and HTTP Strict Transport Security (HSTS). Sites with a period appended were treated as having a different origin than sites without the period. If an attacker had a security certificate for a domain with the added period, this would allow for a Man-in-the-middle (MITM) attack on users. - CVE-2015-0834 (information leak): Security researcher Alexander Kolesnik reported while the Mozilla platform does not yet support TLS connections to TURN and STUN servers, the WebRTC implementation would accept turns: and stuns: URIs and then attempt plaintext connections to the servers when these were used. This can lead to disclosure of credentials through a Man-in-the-middle (MITM) attack as the connection is not encrypted. - CVE-2015-0835, CVE-2015-0836 (remote code execution): Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Impact ====== A remote attacker may be able to access sensitive information from the memory or from files stored locally, crash the browser or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0819 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0821 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0822 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0823 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0824 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0825 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0826 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0827 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0829 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0830 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0831 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0832 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0834 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0835 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0836

1 0

[arch-security] [ASA-201502-13] samba: arbitrary code execution
by Levente Polyak 23 Feb '15

23 Feb '15

Arch Linux Security Advisory ASA-201502-13 ========================================== Severity: High Date : 2015-02-23 CVE-ID : CVE-2015-0240 Package : samba Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package samba before version 4.1.17-1 is vulnerable to arbitrary code execution with root privileges. Resolution ========== Upgrade to 4.1.17-1. # pacman -Syu "samba>=4.1.17-1" The problem has been fixed upstream in version 4.1.17. Workaround ========== To mitigate the possibility of exploitation before you can perform a full update, add the following line to the [global] section of the /etc/samba/smb.conf configuration file: rpc_server:netlogon=disabled For the configuration change to take effect, the smbd daemon must be restarted. Description =========== A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges. This flaw arises because of an uninitialized pointer is passed to the TALLOC_FREE() function. (Samba uses embedded talloc for memory management and does not rely on the glibc malloc family to function). It can be exploited by calling the ServerPasswordSet RPC api on the NetLogon endpoint, by using a NULL session over IPC. In Samba 4.1 and above, this crash can only be triggered after setting “server schannel = yes” in the server configuration. This is due to the adbe6cba005a2060b0f641e91b500574f4637a36 commit, which introduces NULL initialization into the most common code path. It is still possible to trigger an early return with a memory allocation failure, but that is less likely to occur. Impact ====== A remote unauthenticated attacker is able to send specially crafted packets to execute arbitrary code with root privileges. References ========== https://www.samba.org/samba/history/samba-4.1.17.html https://access.redhat.com/security/cve/CVE-2015-0240 https://bugs.archlinux.org/task/43923

1 0

[arch-security] [ASA-201502-12] krb5: multiple issues
by Remi Gacogne 17 Feb '15

17 Feb '15

Arch Linux Security Advisory ASA-201502-12 ========================================== Severity: High Date : 2015-02-17 CVE-ID : CVE-2014-5352 CVE-2014-5353 CVE-2014-5354 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 Package : krb5 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package krb5 before version 1.13.1-1 is vulnerable to multiple issues including authenticated remote code execution, authenticated remote denial of service, authenticated remote privilege escalation and remote information leak. Resolution ========== Upgrade to 1.13.1-1. # pacman -Syu "krb5>=1.13.1-1" The problem has been fixed upstream in version 1.13.1. Workaround ========== None. Description =========== - CVE-2014-5352 (authenticated remote code execution): In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind are vulnerable as they can be instructed to call gss_process_context_token(). - CVE-2014-5353 (authenticated remote denial of service): In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause a NULL dereference by attempting to use a named ticket policy object as a password policy for a principal. The attacker needs to be authenticated as a user who has the elevated privilege for setting password policy by adding or modifying principals. - CVE-2014-5354 (authenticated remote denial of service): In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause a NULL dereference by inserting into the database a principal entry which contains no long-term keys. - CVE-2014-9421 (authenticated remote code execution): If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may perform use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications may also be vulnerable if they contain insufficiently defensive XDR functions. - CVE-2014-9422 (privilege escalation): The MIT krb5 kadmind daemon incorrectly accepts authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm. - CVE-2014-9423 (unauthenticated remote information leak): libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients. Impact ====== A remote, unauthenticated attacker can retrieve sensitive information from the memory of the affected system. A remote authenticated attacker can crash the affected process, escalate to administrative privileges and execute arbitrary code. References ========== http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt https://access.redhat.com/security/cve/CVE-2014-5352 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5353 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5354 https://access.redhat.com/security/cve/CVE-2014-9421 https://access.redhat.com/security/cve/CVE-2014-9422 https://access.redhat.com/security/cve/CVE-2014-9423 http://www.openwall.com/lists/oss-security/2014/12/16/1

1 0