[arch-security] [ASA-201705-18] libplist: multiple issues

[Santiago Torres-Arias]

Arch Linux Security Advisory ASA-201705-18
==========================================

Severity: High
Date    : 2017-05-16
CVE-ID  : CVE-2017-5209 CVE-2017-5545 CVE-2017-5834 CVE-2017-5835
          CVE-2017-5836 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437
          CVE-2017-6438 CVE-2017-6439 CVE-2017-6440
Package : libplist
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-215

Summary
=======

The package libplist before version 2.0.0-1 is vulnerable to multiple
issues including arbitrary command execution, denial of service and
information disclosure.

Resolution
==========

Upgrade to 2.0.0-1.

# pacman -Syu "libplist>=2.0.0-1"

The problems have been fixed upstream in version 2.0.0.

Workaround
==========

None.

Description
===========

- CVE-2017-5209 (information disclosure)

The base64decode function in base64.c in libimobiledevice libplist
through 1.12 allows attackers to obtain sensitive information from
process memory or cause a denial of service (buffer over-read) via
split encoded Apple Property List data.

- CVE-2017-5545 (denial of service)

The main function in plistutil.c in libimobiledevice libplist through
1.12 allows attackers to obtain sensitive information from process
memory or cause a denial of service (buffer over-read) via Apple
Property List data that is too short.

- CVE-2017-5834 (denial of service)

The parse_dict_node function in bplist.c in libplist allows attackers
to cause a denial of service (out-of-bounds heap read and crash) via a
crafted file.

- CVE-2017-5835 (denial of service)

libplist allows attackers to cause a denial of service (large memory
allocation and crash) via vectors involving an offset size of zero.

- CVE-2017-5836 (denial of service)

The plist_free_data function in plist.c in libplist allows attackers to
cause a denial of service (crash) via vectors involving an integer node
that is treated as a PLIST_KEY and then triggers an invalid free.

- CVE-2017-6435 (denial of service)

The parse_string_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory
corruption) via a crafted plist file.

- CVE-2017-6436 (denial of service)

The parse_string_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory allocation
error) via a crafted plist file.

- CVE-2017-6437 (denial of service)

The base64encode function in base64.c in libimobiledevice libplist 1.12
allows local users to cause a denial of service (out-of-bounds read)
via a crafted plist file.

- CVE-2017-6438 (arbitrary command execution)

Heap-based buffer overflow in the parse_unicode_node function in
bplist.c in libimobiledevice libplist 1.12 allows local users to cause
a denial of service (out-of-bounds write) and possibly code execution
via a crafted plist file.

- CVE-2017-6439 (denial of service)

Heap-based buffer overflow in the parse_string_node function in
bplist.c in libimobiledevice libplist 1.12 allows local users to cause
a denial of service (out-of-bounds write) via a crafted plist file.

- CVE-2017-6440 (denial of service)

The parse_data_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory allocation
error) via a crafted plist file.

Impact
======

An attacker is able to crash the process, read sensitive information or
execute arbitrary code on the host by providing a crafted plist file or
string.

References
==========

https://github.com/libimobiledevice/libplist/issues/93
https://github.com/libimobiledevice/libplist/issues/94
https://github.com/libimobiledevice/libplist/issues/95
https://github.com/libimobiledevice/libplist/issues/99
https://github.com/libimobiledevice/libplist/issues/98
https://github.com/libimobiledevice/libplist/issues/100
https://github.com/libimobiledevice/libplist/blob/master/NEWS
https://bugzilla.redhat.com/show_bug.cgi?id=1412613
https://bugzilla.redhat.com/show_bug.cgi?id=1416002
https://bugzilla.redhat.com/show_bug.cgi?id=1418591
https://bugzilla.redhat.com/show_bug.cgi?id=1418592
https://bugzilla.redhat.com/show_bug.cgi?id=1418593
https://security.archlinux.org/CVE-2017-5209
https://security.archlinux.org/CVE-2017-5545
https://security.archlinux.org/CVE-2017-5834
https://security.archlinux.org/CVE-2017-5835
https://security.archlinux.org/CVE-2017-5836
https://security.archlinux.org/CVE-2017-6435
https://security.archlinux.org/CVE-2017-6436
https://security.archlinux.org/CVE-2017-6437
https://security.archlinux.org/CVE-2017-6438
https://security.archlinux.org/CVE-2017-6439
https://security.archlinux.org/CVE-2017-6440
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170517/0a88d9e9/attachment.asc>