Security
Apt vulnerability sparks Debian security discussion
Downloading packages from a distribution's repositories is generally considered to be a safe operation—packages are (or at least should be) signed and those signatures are verified before installation. Debian's Apt package manager has used cryptographic signatures to verify the authenticity of packages for more than ten years. So it was a rather large surprise to see a late May report that Apt doesn't require valid signatures for source packages.
Jakub Wilk found the bug when testing repositories with packages that didn't have any signatures. By using a proxy that returned 404 "not found" errors for any requests targeting Release.gpg or InRelease files (which hold the signatures), he found that installing or downloading binary packages failed (as expected). But he also found that downloading or unpacking a source package worked, as did building a binary package from the downloaded source package. That is clearly a flaw that a man in the middle (MITM) could exploit to put compromised source files onto Debian systems.
It is a difficult vulnerability to exploit, perhaps, and would require user assistance (i.e. building the package) to activate a malicious payload, but it certainly runs afoul of reasonable expectations. One can also imagine targeted attacks using the vulnerability that could be far more destructive. Worse yet, though, is that the normal methods for rebuilding the Debian archive (e.g. for a new architecture) would not detect this kind of tampering, as Thorsten Glaser pointed out. Those methods assume that apt-get source pkg always verifies the signature.
The problem in Apt was fixed quickly. The function that handles source packages simply needed to call the IsTrusted() method to verify the signature. In addition, a test case was added to catch this if the bug ever reappears. The bug was then closed by Michael Vogt on June 10, only to be reopened by Christoph Anton Mitterer two days later.
Although there was mention of contacting the security team in the bug, that
evidently never happened. So one of the reasons that Mitterer reopened the
issue was to ensure that a CVE got assigned and that a Debian Security
Advisory (DSA) was issued. As he put it: "So IMHO this bug definitely deserves a CVE and a DSA,... so that people
are informed that [their] systems might have been compromised (i.e. if an
attacker tricked them into using forged sources)
". A CVE was duly
assigned (CVE-2014-0478) and DSA-2958-1 was
issued.
But there are a number of larger issues here. Mitterer outlines some
of them in his lengthy bug-reopening message. He is concerned that various
pieces
of Debian
infrastructure are insufficiently secure against (mostly) MITM attacks.
For example, Apt will work with unsigned repositories, which is seen as a
feature by some. As David Kalnischkies said: "The 'problem; is that apt supports unsigned repositories as too many
people would bitch too much if it would require a signature – it used
to work before apt 0.6, it has to work forever, man – FOR EVER!
"
Glaser's description of the potential MITM problems with sbuild and cowbuilder also factor in.
Beyond those, Mitterer wondered about the security verification in packages that download code from
elsewhere (e.g. Tor browser or Flash plugin) and other Debian tools that grab
code to be built or to create new systems (e.g. debootstrap).
But there is more to improving the security of Debian (or any project, for that matter) than just compiling lists of problem areas. As security team member Thijs Kinkhorst pointed out in a post to the debian-devel mailing list—where parts of the discussion moved—finding some piece of the problem to work on may be a better approach:
I suggest that you focus on one of those aspects of your email and take some concrete action to get it addressed.
Kalnischkies had a similar comment:
So instead of answering all your questions, I will instead leave them unanswered and say: Go on and check for yourself! You shouldn't trust a random guy like me anyway and if that leads to even one person contributing to apt (or the security team or anything else really) in this area, we have a phenomenal massive increase in manpower … (for apt in the 50% ballpark!)
But there certainly is value in collecting up problem areas and trying to figure what the "proper" solution should be, Mitterer argued. Because many of the solutions would require fairly major changes to how things are done and what types of behavior are allowed—policy decisions, essentially—they are not things that Mitterer (or any single developer) can directly address without involving others.
It's clear that there are some holes in Debian's packaging infrastructure.
Beyond the bug that Wilk just found, he also encountered a bug
that was reported over a year ago regarding the hash checking done for
source packages. It turns out that Apt only checks the MD5 hash, even if
there are SHA1 or SHA256 hashes available for the package. That seems rather
sloppy, even though it may be hard
or impossible to exploit—as Kalnischkies put
it: "If you happen to have a same-size preimage attack on MD5 I would be
interested to hear about it.
"
Mitterer is trying to raise the profile of these problems—with many lengthy replies throughout the bug and mailing list threads—but there is little evidence that much progress has been made. Some of the problems may be less dangerous or harder to exploit than Mitterer makes them out to be, but they add up to something that should be a bit worrisome. The inertia of a long-running project may be working against some kind of concerted effort to address the problems, as "we've always done it that way" can sometimes be a powerful, if potentially problematic, argument. It will be interesting to see what, if any, attention these problems get over time—it may require someone to drive the process with more than just ideas and words.
Brief items
Security quotes of the week
The encryption and security systems that 'private' companies are launching in the wake of [these] 'revelations', however, are in fact being covertly funded by the NSA/GCHQ — the aim being to encourage criminals and terrorists to use these systems, which the security agencies have built massive backdoors into.
It's also worth noting that while this antidote doesn't detect the decryption password automatically, it could be possible to do so. However, future versions of the ransomware will probably not reveal the decryption password so easily and will likely receive it from the C&C [Command and Control] server.
Since the Simplelocker ransomware is a proof-of-concept, the antidote provided here is simply a solution to this proof-of-concept. Future versions of advanced smartphone ransomware will likely prove significantly harder to reverse engineer.
Android Root Access Vulnerability Affecting Most Devices (Threatpost)
Threatpost reports that most Android devices are vulnerable to a privilege escalation flaw in the kernel. "Researchers at Lacoon Mobile Security are calling the bug “TowelRoot,” because it is the very same vulnerability (CVE-2014-3153) exploited in the latest Android rooting tool developed by George Hotz (Geohot). Successful exploitation of the Linux bug within the Android operating system would give the attacker administrative access to a victim’s phone. Specifically, such access could potentially allow that same attacker to run further malicious code, retrieve files and device data, bypass third-party or enterprise security applications including containers like Samsung’s secure Knox sub-operating system, and establish backdoors for future access on victim devices."
New vulnerabilities
apt: invalid source package authentication
| Package(s): | apt | CVE #(s): | CVE-2014-0478 | ||||||||
| Created: | June 13, 2014 | Updated: | June 18, 2014 | ||||||||
| Description: | From the Debian advisory:
Jakub Wilk discovered that APT, the high level package manager, did not properly perform authentication checks for source packages downloaded via "apt-get source". This only affects use cases where source packages are downloaded via this command; it does not affect regular Debian package installation and upgrading. | ||||||||||
| Alerts: |
| ||||||||||
chromium: multiple vulnerabilities
| Package(s): | chromium-browser | CVE #(s): | CVE-2014-3154 CVE-2014-3155 CVE-2014-3156 CVE-2014-3157 | ||||||||||||||||||||
| Created: | June 16, 2014 | Updated: | October 10, 2014 | ||||||||||||||||||||
| Description: | From the CVE entries:
Use-after-free vulnerability in the ChildThread::Shutdown function in content/child/child_thread.cc in the filesystem API in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown. (CVE-2014-3154) net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance. (CVE-2014-3155) Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc. (CVE-2014-3156) Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library. (CVE-2014-3157) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2014-3940 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 12, 2014 | Updated: | July 30, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
kernel: information leak
| Package(s): | kernel | CVE #(s): | CVE-2014-1739 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 17, 2014 | Updated: | June 18, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the oss-sec mailing list:
We found an infoleak vulnerability in the ioctl media_enum_entities() that allows to disclose 200 bytes the kernel process' stack. The vulnerability is exploitable on versions up to linux-3.15-rc3 by local users with read access to `/dev/media0`. Linux distributions ship with `chmod 600 /dev/media0` preventing unprivileged local users from exploiting the vulnerability. However, some Android devices are known to be shipped with both read and/or write permissions for all: chmod 666 /dev/media0. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2012-6647 | ||||||||||||||||||||||||
| Created: | June 18, 2014 | Updated: | June 18, 2014 | ||||||||||||||||||||||||
| Description: | From the CVE entry:
The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libfep: privilege escalation
| Package(s): | libfep | CVE #(s): | CVE-2014-3980 | ||||||||
| Created: | June 18, 2014 | Updated: | June 18, 2014 | ||||||||
| Description: | From the CVE entry:
libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges via unspecified vectors. | ||||||||||
| Alerts: |
| ||||||||||
lucene-solr: multiple vulnerabilities
| Package(s): | lucene-solr | CVE #(s): | CVE-2013-6397 CVE-2013-6407 CVE-2013-6408 | ||||
| Created: | June 18, 2014 | Updated: | June 18, 2014 | ||||
| Description: | From the CVE entries:
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries. (CVE-2013-6397) The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. (CVE-2013-6407) The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407. (CVE-2013-6408) | ||||||
| Alerts: |
| ||||||
lynis: privilege escalation
| Package(s): | lynis | CVE #(s): | CVE-2014-3982 CVE-2014-3986 | ||||
| Created: | June 18, 2014 | Updated: | June 18, 2014 | ||||
| Description: | From the CVE entries:
include/tests_webservers in Lynis before 1.5.5 on AIX allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.##### file. (CVE-2014-3982) include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name. (CVE-2014-3986) | ||||||
| Alerts: |
| ||||||
nova: privilege escalation
| Package(s): | nova | CVE #(s): | CVE-2013-1068 CVE-2014-0167 | ||||||||||||||||
| Created: | June 18, 2014 | Updated: | July 14, 2014 | ||||||||||||||||
| Description: | From the CVE entry:
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests. (CVE-2014-0167) From the Ubuntu advisory: Darragh O'Reilly discovered that OpenStack Nova did not properly set up its sudo configuration. If a different flaw was found in OpenStack Nova, this vulnerability could be used to escalate privileges. This issue only affected Ubuntu 13.10 and Ubuntu 14.04 LTS. (CVE-2013-1068) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
opera: multiple vulnerabilities
| Package(s): | opera | CVE #(s): | CVE-2012-6461 CVE-2012-6462 CVE-2012-6463 CVE-2012-6464 CVE-2012-6465 CVE-2012-6466 CVE-2012-6467 CVE-2012-6468 CVE-2012-6469 CVE-2012-6470 CVE-2012-6471 CVE-2012-6472 CVE-2013-1618 CVE-2013-1637 CVE-2013-1638 CVE-2013-1639 | ||||
| Created: | June 16, 2014 | Updated: | June 18, 2014 | ||||
| Description: | From the Gentoo advisory:
A remote attacker could entice a user to open a specially crafted web page using Opera, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to obtain sensitive information, conduct Cross-Site Scripting (XSS) attacks, or bypass security restrictions. | ||||||
| Alerts: |
| ||||||
php5, gd: denial of service
| Package(s): | php5, gd | CVE #(s): | CVE-2014-2497 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 12, 2014 | Updated: | March 29, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
php5: code execution
| Package(s): | php5 | CVE #(s): | CVE-2014-4049 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 17, 2014 | Updated: | July 31, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
It was discovered that PHP, a general-purpose scripting language commonly used for web application development, is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
php-horde-Horde-Ldap: check for empty passwords
| Package(s): | php-horde-Horde-Ldap | CVE #(s): | |||||
| Created: | June 18, 2014 | Updated: | June 18, 2014 | ||||
| Description: | From the Red Hat bugzilla:
It was reported that php-horde-Horde-Ldap could be used to connect to an LDAP server with an empty password. In this case, the flaw is in the LDAP server, so this issue is just considered hardening. | ||||||
| Alerts: |
| ||||||
python-djblets: cross-site scripting
| Package(s): | python-djblets | CVE #(s): | CVE-2014-3994 | ||||||||||||
| Created: | June 18, 2014 | Updated: | June 18, 2014 | ||||||||||||
| Description: | From the CVE entry:
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name. | ||||||||||||||
| Alerts: |
| ||||||||||||||
typo3-cms-4_5: multiple vulnerabilities
| Package(s): | typo3-cms-4_5 | CVE #(s): | CVE-2014-3941 CVE-2014-3942 CVE-2014-3943 | ||||||||||||
| Created: | June 18, 2014 | Updated: | June 18, 2014 | ||||||||||||
| Description: | From the CVE entries:
TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing." (CVE-2014-3941) The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object. (CVE-2014-3942) Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters. (CVE-2014-3943) | ||||||||||||||
| Alerts: |
| ||||||||||||||
xen: denial of service
| Package(s): | xen | CVE #(s): | CVE-2014-3967 CVE-2014-3968 | ||||||||||||||||||||||||
| Created: | June 17, 2014 | Updated: | June 26, 2014 | ||||||||||||||||||||||||
| Description: | From the xen advisory:
The implementation of the HVM control operation HVMOP_inject_msi, while checking whether a particular IRQ was already set up in the necessary way, fails to properly check all respective conditions. In particular it doesn't check the returned pointer for being non-NULL before de- referencing it. (CVE-2014-3967) Furthermore that same code also handles certain errors by logging messages, without (under default settings) at least making these messages subject to rate limiting. (CVE-2014-3968) The NULL pointer de-reference would lead to a host crash, and hence a denial of service would result. Since host and guest page tables are fully separated for HVM guests, the guest would not be able to leverage the vulnerability for other kinds of attacks (privilege escalation or information leak). The spamming of the hypervisor log could similarly lead to a denial of service. In a configuration where device models run with limited privilege (for example, stubdom device models), a guest attacker who successfully finds and exploits an unfixed security flaw in qemu-dm could leverage the other flaw into a Denial of Service affecting the whole host. In the more general case, in more abstract terms: a malicious administrator of a domain privileged with regard to an HVM guest can cause Xen to become unresponsive leading to a Denial of Service. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>