Security
The WebCrypto API
The World Wide Web Consortium (W3C) is developing a JavaScript API that encompasses a number of useful cryptographic operations for use in situations ranging from signature verification to end-to-end data encryption. Called the Web Cryptography API (or WebCrypto for short), the standard is currently at "Last Call" working draft status with the Web Cryptography Working Group. There are a few lingering issues that may still result in some changes before the API advances to the next stage in the W3C recommendation process, but WebCrypto also faces fundamental criticisms; for instance, that it does not specify those elements on which users actually need standardization—namely, algorithms. And there is always the concern that such an API is risky because the security functions it offers may be inherently untrustable in precisely those scenarios where they are most needed.
The most recent draft of WebCrypto is available in raw form from the W3C version control system. This version reflects some changes since the Last Call was was made on March 25. The Last Call resulted in a number of new issues being created; at this point the working group appears to be aiming at resolving all of those by the middle of July.
The WebCrypto draft begins by setting out its anticipated use cases, most of which are standard web application concerns: client-to-server authentication, sending and storing encrypted files (including those encrypted by the server and those encrypted on the client side), plus making and checking digital signatures. These standard operations are the type of functions that web applications already implement, but with each implementor reinventing the wheel in its own JavaScript code. If browsers offer key generation, signature checking, and data encryption, the thinking goes, there will less duplication of effort and (hopefully) higher-quality code.
Derived from its basic use cases, the draft defines four main APIs and an algorithm dictionary that, together, address the essential cryptographic primitives needed by those use cases. The APIs are RandomSource, which exposes a cryptographically strong pseudorandom number generator (PRNG); CryptoKey, which is an abstraction covering various types of cryptographic keys (including public, private, and shared secret keys, of a variety of algorithms); SubtleCrypto, which is the low-level API for accessing functionality like encryption, decryption, key generation, hash generation, and verification; and WorkerCrypto, which is the interface for Web Worker background scripts. A higher-level Crypto API is also defined, which wraps together SubtleCrypto and RandomSource. The Algorithm dictionary stores the list of supported algorithms available in the browser for various functions.
From an interface standpoint, tracking the keys on the system is a relatively straightforward affair. Each public/private key pair, for instance, is represented by a pair of CryptoKey objects and an entry in the CryptoKeyPair dictionary indicating that the two go together. The specification allows each key to be designated for certain operations (e.g., encryption, decryption, signatures, verification). There is also a boolean attribute, extractable, that allows the user agent to designate that the key's raw material may be exported (for example, to back up the key elsewhere, perhaps even offline).
In contrast, the SubtleCrypto interface occupies the larger portion of the specification, encompassing a dozen operations. But even these "low-level" cryptographic methods ultimately fall back on the underlying algorithms for meaning; after all, calling the digest() method to check the integrity of a block of data is risky if one specifies a broken hash function (like SHA-1) as a parameter. Therein lies the source of many of the complaints about WebCrypto: the working group is explicitly not setting out to recommend a set of safe, reliable algorithms to use. Rather, it is attempting to define an API for calling and working with those algorithms.
As a result, WebCrypto includes a sizable list of algorithm descriptions, but none of them are mandatory to implement. Worse yet, according to some critics, the specification does not provide implementors with guidelines as to what options and parameters are safe to use. There are, for instance, known practical attacks [PDF] against some older algorithms such as RSA PKCS#1 v1.5. WebCrypto includes RSA PKCS#1 v1.5 in its list of supported algorithms, even including a basic mapping of the algorithm onto WebCrypto's methods and attributes.
Several working group members also expressed dissatisfaction at the absence of some newer algorithms, such as Daniel J. Bernstein's Curve25519. But WebCrypto co-editor Ryan Sleevi argues that the specification's role should be limited to describing the functionality that is already available in web browsers, rather than blessing algorithms that, while mathematically desirable, have yet to be implemented.
Curve25519, he notes, is not something that a web application developer can count on being available:
As noted, the cryptographic libraries of two major implementors are presently tied to major OS releases. The two cryptographic libraries in use by the other implementors (NSS and OpenSSL) equally lack implementations of Curve25519.
There is no specification of Curve25519. The IETF has made talks of it, but has yet to actually make headway. It is simply "The code speaks for itself". While there are many implementations of Curve25519, for different platforms, they are all based on the same djb initial code and still re-use aspects of it.
Of course, deciding on a suite of recommended cryptographic algorithms would be a difficult task for any standards body, since it is difficult to agree on what constitutes "safe" algorithms and parameters. For instance, when the Edward Snowden leaks demonstrated that the Dual_EC_DRBG PRNG from the National Institute of Standards and Technology (NIST) had been compromised with an NSA backdoor, some felt that other NIST recommendations, such as its elliptic curves, were surely compromised as well. But that has yet to be proven.
At present, the working group seems ready to compromise on the Curve25519 issue by drafting a complementary specification that describes Curve25519 (as well as another option promoted by Microsoft, known as the "MSR" curves) that could later be merged into an update to WebCrypto. That approach would allow the current WebCrypto specification to continue its progress through the W3C recommendation process.
There are, however, also lingering criticisms of WebCrypto that take issue with a more fundamental facet of the specification: the fact that it describes cryptography that will ultimately be implemented in JavaScript. As Tony Arcieri put it in a blog post, "the convenience of the web stems from the fact it’s a frictionless application delivery platform. Unfortunately, it does not rely on a comprehensive cryptographically secure signature system to determine content is authentic, but instead just trusts whatever is sitting around on the server at the time you access it.
"
In other words, web-based cryptography should not be trusted to protect the user's interests. It may be useful for web application developers, but the browser is not a trustworthy execution environment for end-to-end encryption of users' secrets. While there are valid uses for WebCrypto, Arcieri says, he fears that it will also be used to implement applications that ostensibly protect the user's data. For instance, he notes the possibility of secure-storage services akin to MEGA, which advertise features like cryptographically secure cloud storage, but are in actuality susceptible to multiple attack vectors.
One might answer Arcieri's charge by pointing out that services like MEGA exist already, and that existing services simply implement their own encryption stack rather than relying on a standard, hopefully well-vetted API. But the underlying concern remains: application code that is delivered to the browser over the web should not be treated with the same level of trust as locally installed and verified packages. A web application that uses the WebCrypto APIs may indeed be free from man-in-the-middle attackers; the risk is simply that the user cannot know one way or other for certain. Regardless of the algorithms employed, that lack of verification places an upper bound on how much trust should be extended.
[Thanks to Paul Wise.]
Brief items
Security quotes of the week
Decades-Old Vulnerability Threatens 'Internet Of Things' (Dark Reading)
Dark Reading writes about a newly-discovered bug that has existed for 20 years in multiple LZO compression implementations. "Patches for the integer overflow bug, which allows an attacker to cripple systems running the so-called Lempel-Ziv-Oberhumer (LZO) code with denial-of-service type attacks as well as remote code execution, were issued the past few days for the Linux kernel, as well as for various open-source media libraries. LZO handles high-speed compression and decompression of IP network traffic and files, typically images, in embedded systems. 'The most popular use is in image data, decompressing photos taken, raw images taken from a camera or video stream,' says Don Bailey, mobile and embedded systems security expert with Lab Mouse Security, who discovered the vulnerability while manually auditing the code."
New vulnerabilities
asterisk: multiple vulnerabilities
| Package(s): | asterisk | CVE #(s): | CVE-2014-4046 CVE-2014-4047 | ||||||||||||||||||||||||
| Created: | June 27, 2014 | Updated: | September 19, 2014 | ||||||||||||||||||||||||
| Description: | From the CVE entries: Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action. (CVE-2014-4046) Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections. (CVE-2014-4047) | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
freerdp: two vulnerabilities
| Package(s): | freerdp | CVE #(s): | CVE-2014-0250 CVE-2014-0791 | ||||||||||||||||||||||||
| Created: | July 1, 2014 | Updated: | September 28, 2016 | ||||||||||||||||||||||||
| Description: | From the CVE entry:
Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet. (CVE-2014-0791) From the openSUSE advisory: Integer overflows in memory allocations in client/X11/xf_graphics.c (CVE-2014-0250) | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
kdelibs: information disclosure
| Package(s): | kdelibs | CVE #(s): | CVE-2014-3494 | ||||||||||||||||
| Created: | July 1, 2014 | Updated: | July 7, 2014 | ||||||||||||||||
| Description: | From the KDE advisory:
The POP3 kioslave used by kmail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked. This flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2014-4508 CVE-2014-4667 CVE-2014-4608 CVE-2014-4611 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 30, 2014 | Updated: | August 12, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
[CVE-2014-4508]: Linux kernel built with the system-call auditing support(CONFIG_AUDITSYSCALL) for 32-bit platforms is vulnerable to a crash caused by erroneous handling of bad system call numerals. It occurs during syscall(2) calls, if system-call auditing is enabled on the system. An unprivileged user/process could use this flaw to crash the system kernel resulting in DoS. [CVE-2014-4667]: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. A remote attacker can block further connection to the particular sctp server socket by sending a specially crafted sctp packet. [CVE-2014-4608]: An integer overflow can occur when processing any variant of a "literal run" in the lzo1x_decompress_safe function. Each of these three locations is subject to an integer overflow when processing zero bytes. This exposes the code that copies literals to memory corruption. An interesting side effect of the vulnerable code is that the value of 'op' can point to a region of memory just before the start of 'out'. It should be noted that on 64bit architectures, the overflow is still possible, but impractical. An overflow would require so much input data that an attack would obviously be infeasible even on modern computers. [CVE-2014-4611]: Don A. Bailey of Lab Mouse Security reported an integer overflow issue in various implementations of LZO (Lempel–Ziv–Oberhumer) and LZ4 compression algorithms. The issue is in the handling of "literal runs" during decompression, and can lead to application crash and, possibly, code execution. This bug is for LZ4 and LZ4 copy embedded in the Linux kernel (as of version 3.11). This issue can not be triggered on 64bit systems today, as it would require input of the size that is beyond capabilities of modern computers. On 32bit systems, this can only affect applications using sufficiently large decompression blocks (16mb+). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libemail-address-perl: denial of service
| Package(s): | libemail-address-perl | CVE #(s): | CVE-2014-0477 | ||||||||||||||||||||||||
| Created: | June 30, 2014 | Updated: | October 28, 2014 | ||||||||||||||||||||||||
| Description: | From the Debian advisory:
Bastian Blank reported a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation. Email::Address::parse used significant time on parsing empty quoted strings. A remote attacker able to supply specifically crafted input to an application using Email::Address for parsing, could use this flaw to mount a denial of service attack against the application. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
novell-qtgui, novell-ui-base: privilege escalation
| Package(s): | novell-qtgui, novell-ui-base | CVE #(s): | CVE-2014-0595 | ||||
| Created: | June 26, 2014 | Updated: | July 2, 2014 | ||||
| Description: | From the Novell bugzilla entry:
/opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certain array, which allows local users to obtain the S permission in opportunistic circumstances by leveraging the granting of the F permission by an administrator. | ||||||
| Alerts: |
| ||||||
openfire: multiple vulnerabilities
| Package(s): | openfire | CVE #(s): | CVE-2009-1595 CVE-2009-1596 CVE-2014-2741 | ||||
| Created: | July 1, 2014 | Updated: | July 2, 2014 | ||||
| Description: | From the CVE entries:
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action. (CVE-2009-1595) Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet. (CVE-2009-1596) nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. (CVE-2014-2741) | ||||||
| Alerts: |
| ||||||
openstack-keystone: privilege escalation
| Package(s): | openstack-keystone | CVE #(s): | CVE-2014-3476 | ||||||||||||
| Created: | June 26, 2014 | Updated: | July 31, 2014 | ||||||||||||
| Description: | From the Novell bugzilla entry:
OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles. | ||||||||||||||
| Alerts: |
| ||||||||||||||
openstack-neutron: denial of service
| Package(s): | openstack-neutron | CVE #(s): | CVE-2014-4167 | ||||||||||||
| Created: | June 26, 2014 | Updated: | July 2, 2014 | ||||||||||||
| Description: | From the Red Hat bugzilla entry:
Thiago Martins from Hewlett Packard reported a vulnerability in Neutron L3-agent. By creating an IPv6 private subnet attached to a L3 router, an authenticated user may break the L3-agent, preventing further floating IPv4 addresses from being attached for the entire cloud. Note: removal of the faulty network can not be done using the API and must be cleaned at the database level. Only Neutron setups using IPv6 and L3-agent are affected. | ||||||||||||||
| Alerts: |
| ||||||||||||||
php: multiple vulnerabilities
| Package(s): | php | CVE #(s): | CVE-2014-3981 CVE-2014-0207 CVE-2014-3478 CVE-2014-3479 CVE-2014-3480 CVE-2014-3487 CVE-2014-3515 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 30, 2014 | Updated: | September 11, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Fedora advisory:
Insecure temporary file use in the configure script. (CVE-2014-3981) fileinfo: cdf_read_short_sector insufficient boundary check. (CVE-2014-0207) fileinfo: mconvert incorrect handling of truncated pascal string size. (CVE-2014-3478) fileinfo: cdf_check_stream_offset insufficient boundary check. (CVE-2014-3479) fileinfo: cdf_count_chain insufficient boundary check. (CVE-2014-3480) fileinfo: cdf_read_property_info insufficient boundary check. (CVE-2014-3487) unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion. (CVE-2014-3515) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
phpmyadmin: cross-site scripting
| Package(s): | phpmyadmin | CVE #(s): | CVE-2014-4349 | ||||||||||||||||||||
| Created: | June 27, 2014 | Updated: | July 30, 2014 | ||||||||||||||||||||
| Description: | From the Mageia advisory: In phpMyAdmin before 4.1.14, it is possible to trigger an XSS when hiding or unhiding a crafted table name in the navigation, due to unescaped HTML output in the navigation items hiding feature. Note that this vulnerability can only be triggered by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
python: information disclosure
| Package(s): | python | CVE #(s): | CVE-2014-4616 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | June 30, 2014 | Updated: | July 24, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the python bug report:
Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstring function: the string to be decoded and the index. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
python-simplejson: information disclosure
| Package(s): | python-simplejson | CVE #(s): | |
| Created: | June 27, 2014 | Updated: | July 23, 2014 |
| Description: | From the bug report: Python 2 and 3 are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstring function: the string to be decoded and the index. The bug is caused by allowing the user to supply a negative index value. The index value is then used directly as an index to an array in the C code; internally the address of the array and its index are added to each other in order to yield the address of the value that is desired. However, by supplying a negative index value and adding this to the address of the array, the processor's register value wraps around and the calculated value will point to a position in memory which isn't within the bounds of the supplied string, causing the function to access other parts of the process memory. | ||
| Alerts: | (No alerts in the database for this vulnerability) | ||
sos: password disclosure
| Package(s): | sos | CVE #(s): | CVE-2014-0246 | ||||||||
| Created: | June 27, 2014 | Updated: | July 2, 2014 | ||||||||
| Description: | From the Red Hat bug report: When using a GRUB bootloader password, the md5 hash of said password was collected and stored in the resulting archive of debugging information when running sosreport. An attacker able to access the archive could use this flaw to obtain the GRUB bootloader password. | ||||||||||
| Alerts: |
| ||||||||||
swift: cross-site scripting
| Package(s): | swift | CVE #(s): | CVE-2014-3497 | ||||||||
| Created: | June 26, 2014 | Updated: | July 25, 2014 | ||||||||
| Description: | From the Ubuntu advisory:
John Dickinson discovered that Swift did not properly quote the WWW-Authenticate header value. If a user were tricked into navigating to a malicious Swift URL, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. | ||||||||||
| Alerts: |
| ||||||||||
wireshark: code execution
| Package(s): | wireshark | CVE #(s): | CVE-2014-4174 | ||||
| Created: | June 30, 2014 | Updated: | July 2, 2014 | ||||
| Description: | From the CVE entry:
wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted packet-trace file that includes a large packet. | ||||||
| Alerts: |
| ||||||
zabbix: local file inclusion
| Package(s): | zabbix | CVE #(s): | CVE-2014-3005 | ||||||||||||
| Created: | June 30, 2014 | Updated: | October 29, 2014 | ||||||||||||
| Description: | From the Zabbix bug report:
zabbix frontend support xml data import feature,and server-side use DOMDocument to parse xml.DOMDocument also parse the external dtd in default.So attacker can use a crafted xml to read arbitrary local files and send http request use zabbix server as a proxy. | ||||||||||||||
| Alerts: |
| ||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>