Security
The dangers from component firmware
Various kinds of firmware are part and parcel of a modern computer system, but firmware can also leave a system vulnerable to compromise. Google's Kees Cook has been working to add ways to verify firmware that gets loaded into various devices at initialization time. He came to the 2014 Linux Security Summit to talk about the threats posed by firmware—and ways to avoid them.
Boot firmware, like BIOS or UEFI, is not the subject of the talk, Cook said. It is, instead, the "component firmware" for various devices in the system, such as network, storage, and input devices, or even the CPUs in the system. There is "other weird stuff" that also has firmware, including the Trusted Platform Modules (TPMs), which are field-upgradable in some systems.
![[Kees Cook]](https://static.lwn.net/images/2014/lss-cook-sm.jpg)
Who cares?, he asked, what are the threats? Those questions come up a lot and the answer mostly comes down to the physical memory access that these devices have. For example, network and other devices often have DMA capabilities, which potentially gives them a clear view of the memory of the entire system. The best protection is to use the IOMMU (if present) to limit the scope of any attack. These attacks are not theoretical, he said; his slides [PDF] have links to various attack descriptions.
Even if there is a properly configured IOMMU, there are still dangers of data interception and spoofing. Devices like Bluetooth keyboards and hard drives often have firmware that can be used for those purposes. In addition, devices on the Low Pin Count (LPC) bus can imitate legacy keyboards. TPMs and Super I/O controllers both reside on LPC and sometimes have firmware that gets loaded or updated. As another example, reprogramming the hard-drive firmware gives that firmware control over what gets stored on the drive, he said.
The firmware on these tiny devices is "really important if you really care a lot about the integrity of the system", Cook said. Updates to that firmware typically come from user space. We don't want to stop legitimate updates, but we do want to stop those that we don't trust, he said. Many of these types of devices do not even have any persistent storage, they just have a bit of RAM that gets loaded at initialization time. Others have persistent storage that can be updated periodically.
The update process is sometimes mediated by the kernel, but other times it is done using a mechanism directly exposed to user space. Some of the update methods use checksums to verify the transfer of the new data, but few use signatures to verify that the update is legitimate. Furthermore, the component vendors don't want to tell you anything about the update mechanism, he said, so there is no documentation; sometimes the vendor won't even admit to having a way to do updates.
There are various types of update mechanisms, each with its own pros and cons, he said. Some devices have the firmware in ROM or similar read-only storage that cannot be replaced. While that may be good from a security standpoint, it also means that the firmware cannot be fixed. Those kinds of devices can be ruled out of any firmware reprogramming attack scenario, as can devices whose update mechanism is not wired up to anything else in the system. Those devices can only be reprogrammed by physically attaching some kind of hardware, but cannot be affected by software running on the system.
A component could verify a cryptographic signature on the firmware before applying an update, using a vendor-supplied key. That allows for secure firmware updates, but does not allow the system owner to create their own firmware update. The upgradable TPM chips he has looked at do this signature verification and he hopes that all other TPMs that allow upgrades also do so. Another example is a 3G modem that is implemented using a Linux system on an ARM processor; it also cryptographically verifies its updates. But vendor-defined signature verification is still rather uncommon for system components.
An alternative would be to have system-defined cryptographic verification, where the owner could load their own key. Once again that allows secure firmware updates; it also allows owners to create their own firmware updates. This is similar to the UEFI Secure Boot mechanism, but it is "very unlikely" to be implemented by most component vendors, Cook said.
Another mechanism is a per-power-on (or per-boot) toggle that allows updates until a flag in the hardware is set. That would allow the system to do any needed update at boot time, but then to set the flag and thwart attackers from changing the firmware later on. This is a "pretty reasonable middle ground", he said, that component vendors should be able to be convinced into implementing. It shouldn't be too hard of a change for most components, though "super small" components might not implement it. There are still some implementation details to be worked out, including making the boot firmware set the flag when there are power events like resuming from suspend.
There is also a question of how the updates get to the component. If that happens over a bus that the kernel controls (e.g. using reserved I/O memory on the PCI bus), then the updates are as secure as the kernel is, he said. But a kernel API is required to verify the firmware or its origin.
There are lots of update mechanisms that are exposed to user space, though, he said, including the SCSI generic driver, i2c bus, and others. So, some update mechanisms do not even require a root user. For example, some 3G modems expose "AT" commands to do firmware updates. These are difficult for the kernel to intercept for verification purposes.
As a starting point for update mechanisms under kernel control, Cook created the kernel_fw_from_file() LSM hook to intercept and pass judgment on the request_firmware() calls made by drivers. That hook—merged into 3.17—will allow different kinds of verification of the firmware to be done.
One problem with request_firmware() is that it just returns a blob of data that gives no indication of where the data came from. The new hook gets a pointer to a file structure that can be used to reason about the origin of the code. If it came from a cryptographically protected, read-only filesystem (as it does on Chrome OS), it can be trusted implicitly. Otherwise, a signature could be verified (e.g. from a list of blessed signatures) before allowing the firmware load to occur.
Cook also added a testing mechanism that can be used to verify the proper operation of request_firmware() calls. If a kernel is built with CONFIG_TEST_FIRMWARE, it creates a test_firmware.ko module. When loaded, that module will provide a sysfs file to write the name of the firmware to request (/sys/devices/virtual/misc/test_firmware/trigger_request). Then the /dev/test_firmware device can be consulted to determine which firmware (if any) was loaded.
In the future, Cook plans to try to handle verification for more kinds of firmware. For example, SSDs have a bunch of SCSI commands that are used to update their firmware, but how can the kernel intercept that activity? Does it need a parser to detect that behavior? He also would like to work on convincing vendors to implement once-per-boot updates for their components.
Persistent threats that live in the firmware of a system's components are rather worrisome, even if attacks in the wild are not prevalent (as far as we know). That vulnerability is not really on the radar of most Linux users, developers, or kernel hackers, either. But if we are trust our systems, which is what efforts like verified and secure boot are all about, we will need to be more vigilant about component firmware, as well.
Brief items
Containers vs Hypervisors: The Battle Has Just Begun (Linux.com)
Russell Pavlicek looks at the rivalry between containers and hypervisors over at Linux.com. He outlines the arguments for and against each, and follows it up with a description of a new contender for a "cloud operating system": unikernels. "Unikernel systems create tiny VMs. Mirage OS from the Xen Project incubator, for example, has created several network devices that run kilobytes in size (yes, that's “kilobytes” – when was the last time you heard of any VM under a megabyte?). They can get that small because the VM itself does not contain a general-purpose operating system per se, but rather a specially built piece of code that exposes only those operating system functions required by the application. There is no multi-user operating environment, no shell scripts, and no massive library of utilities to take up room – or to subvert in some nefarious exploit. There is just enough code to make the application run, and precious little for a malefactor to leverage. And in unikernels like Mirage OS, all the code that is present is statically type-safe, from the applications stack all the way down to the device drivers themselves. It's not the “end-all be-all” of security, but it is certainly heading in the right direction."
New vulnerabilities
cas-client: security constraints bypass
| Package(s): | cas-client | CVE #(s): | CVE-2014-4172 | ||||||||||||
| Created: | September 2, 2014 | Updated: | September 25, 2014 | ||||||||||||
| Description: | From the Red Hat bugzilla:
It was found that URL encoding used in the back-channel ticket validation of the JA-SIG CAS client was improper. A remote attacker could exploit this flaw to bypass security constraints by injecting URL parameters. | ||||||||||||||
| Alerts: |
| ||||||||||||||
chromium: multiple vulnerabilities
| Package(s): | chromium | CVE #(s): | CVE-2014-0538 CVE-2014-1714 CVE-2014-3168 CVE-2014-3169 CVE-2014-3170 CVE-2014-3171 CVE-2014-3172 CVE-2014-3173 CVE-2014-3174 CVE-2014-3175 CVE-2014-3176 CVE-2014-3177 | ||||||||||||||||||||
| Created: | September 2, 2014 | Updated: | October 10, 2014 | ||||||||||||||||||||
| Description: | From the CVE and NVD entries:
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 allows attackers to execute arbitrary code via unspecified vectors. (CVE-2014-0538) The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard. (CVE-2014-1714) Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper caching associated with animation. (CVE-2014-3168) Use-after-free vulnerability in core/dom/ContainerNode.cpp in the DOM implementation in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal. (CVE-2014-3169) extensions/common/url_pattern.cc in Google Chrome before 37.0.2062.94 does not prevent use of a '\0' character in a host name, which allows remote attackers to spoof the extension permission dialog by relying on truncation after this character. (CVE-2014-3170) Use-after-free vulnerability in the V8 bindings in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper use of HashMap add operations instead of HashMap set operations, related to bindings/core/v8/DOMWrapperMap.h and bindings/core/v8/SerializedScriptValue.cpp. (CVE-2014-3171) The Debugger extension API in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 37.0.2062.94 does not validate a tab's URL before an attach operation, which allows remote attackers to bypass intended access limitations via an extension that uses a restricted URL, as demonstrated by a chrome:// URL. (CVE-2014-3172) The WebGL implementation in Google Chrome before 37.0.2062.94 does not ensure that clear calls interact properly with the state of a draw buffer, which allows remote attackers to cause a denial of service (read of uninitialized memory) via a crafted CANVAS element, related to gpu/command_buffer/service/framebuffer_manager.cc and gpu/command_buffer/service/gles2_cmd_decoder.cc. (CVE-2014-3173) modules/webaudio/BiquadDSPKernel.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 37.0.2062.94, does not properly consider concurrent threads during attempts to update biquad filter coefficients, which allows remote attackers to cause a denial of service (read of uninitialized memory) via crafted API calls. (CVE-2014-3174) Multiple unspecified vulnerabilities in Google Chrome before 37.0.2062.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors, related to the load_truetype_glyph function in truetype/ttgload.c in FreeType and other functions in other components. (CVE-2014-3175) Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3177. (CVE-2014-3176) Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3176. (CVE-2014-3177) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
enigmail: information leak
| Package(s): | enigmail | CVE #(s): | CVE-2014-5369 | ||||||||||||||||||||||||
| Created: | September 3, 2014 | Updated: | September 10, 2014 | ||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
update to version 1.7.2 * bugfix release which contains several bugfixes including mail with only Bcc recipients sent in plain text unexpectedly | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
gtk3: screen lock bypass
| Package(s): | gtk3 | CVE #(s): | CVE-2014-1949 | ||||||||||||||||
| Created: | August 29, 2014 | Updated: | March 30, 2015 | ||||||||||||||||
| Description: | From the Red Hat bug report: Clemens Fries reported that, when using Cinnamon, it was possible to bypass the screensaver lock. An attacker with physical access to the machine could use this flaw to take over the locked desktop session. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
GraphicsMagick: code execution
| Package(s): | GraphicsMagick | CVE #(s): | CVE-2014-1947 | ||||||||||||||||
| Created: | August 29, 2014 | Updated: | September 15, 2014 | ||||||||||||||||
| Description: | From the Red Hat bug report:
A buffer overflow flaw affecting ImageMagick versions prior to 6.8.8-5 when handling PSD images was reported. The clarified meaning of CVE-2014-1947 is now the vulnerability in older ImageMagick versions (such as 6.5.4) that use the "L%02ld" string. The root cause here is that the code did not cover the case of more than 99 layers, which is apparently allowable but relatively uncommon. This has a resultant buffer overflow, e.g, L99\0 is safe but L100\0 is unsafe. When the overflow occurs, it can be described as "1 or more bytes too many." | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
jinja: privilege escalation
| Package(s): | jinja | CVE #(s): | CVE-2014-0012 | ||||||||
| Created: | September 2, 2014 | Updated: | October 6, 2016 | ||||||||
| Description: | From the CVE entry:
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402. | ||||||||||
| Alerts: |
| ||||||||||
kernel: privilege escalation
| Package(s): | kernel | CVE #(s): | CVE-2014-5471 CVE-2014-5472 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | September 2, 2014 | Updated: | September 30, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image cause a denial of service or, potentially, escalate their privileges. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libreoffice: command injection
| Package(s): | libreoffice | CVE #(s): | CVE-2014-3524 | ||||||||
| Created: | September 3, 2014 | Updated: | September 4, 2014 | ||||||||
| Description: | From the Ubuntu advisory:
Rohan Durve and James Kettle discovered LibreOffice Calc sometimes allowed for command injection when opening spreadsheets. If a user were tricked into opening a crafted Calc spreadsheet, an attacker could exploit this to run programs as your login. | ||||||||||
| Alerts: |
| ||||||||||
lua: code execution
| Package(s): | lua | CVE #(s): | CVE-2014-5461 | ||||||||||||||||||||||||||||||||||||
| Created: | September 2, 2014 | Updated: | January 23, 2017 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
A heap-based overflow vulnerability was found in the way Lua, a simple, extensible, embeddable programming language, handles varargs functions with many fixed parameters called with few arguments, leading to application crashes or, potentially, arbitrary code execution. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox thunderbird seamonkey | CVE #(s): | CVE-2014-1553 CVE-2014-1554 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | September 3, 2014 | Updated: | October 13, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman, JW Wang and David Weir discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1553, CVE-2014-1554, CVE-2014-1562) Abhishek Arya discovered a use-after-free during DOM interactions with SVG. If a user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1563) Michal Zalewski discovered that memory is not initialized properly during GIF rendering in some circumstances. If a user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to steal confidential information. (CVE-2014-1564) Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or steal confidential information. (CVE-2014-1565) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | iceweasel firefox thunderbird seamonkey | CVE #(s): | CVE-2014-1562 CVE-2014-1567 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | September 3, 2014 | Updated: | September 29, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
MySQL: multiple unspecified vulnerabilities
| Package(s): | MySQL | CVE #(s): | CVE-2014-2484 CVE-2014-4214 CVE-2014-4233 CVE-2014-4238 CVE-2014-4240 CVE-2014-4243 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | August 29, 2014 | Updated: | September 4, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries: CVE-2014-2484 - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRFTS. CVE-2014-4214 - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRSP. CVE-2014-4233 - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRREP. CVE-2014-4238 - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR. CVE-2014-4240 - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows local users to affect confidentiality and integrity via vectors related to SRREP. CVE-2014-4243 - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to ENFED. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
perl-Plack: information disclosure
| Package(s): | perl-Plack | CVE #(s): | CVE-2014-5269 | ||||||||||||||||||||
| Created: | August 29, 2014 | Updated: | December 15, 2014 | ||||||||||||||||||||
| Description: | From the Red Hat bug report: Plack::App::File would previously strip trailing slashes off provided paths. This in combination with the common pattern of serving files with Plack::Middleware::Static could allow an attacker to bypass a whitelist of generated files. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
php: multiple vulnerabilities
| Package(s): | php | CVE #(s): | CVE-2013-1824 CVE-2013-3735 CVE-2013-4636 CVE-2014-5120 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | August 29, 2014 | Updated: | September 4, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries: CVE-2013-1824 - The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. CVE-2013-3735 - ** DISPUTED ** The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id." CVE-2013-4636 - The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object. CVE-2014-5120 - gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
postgresql-server: unspecified vulnerability
| Package(s): | postgresql-server | CVE #(s): | CVE-2014-2669 | ||||
| Created: | September 2, 2014 | Updated: | September 4, 2014 | ||||
| Description: | From the CVE entry:
Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions. | ||||||
| Alerts: |
| ||||||
s3ql: code execution
| Package(s): | s3ql | CVE #(s): | CVE-2014-0485 | ||||||||||||
| Created: | August 28, 2014 | Updated: | July 13, 2015 | ||||||||||||
| Description: | From the Debian advisory:
Nikolaus Rath discovered that s3ql, a file system for online data storage, used the pickle functionality of the Python programming language in an unsafe way. As a result, a malicious storage backend or man-in-the-middle attacker was able execute arbitrary code. | ||||||||||||||
| Alerts: |
| ||||||||||||||
smack: man-in-the-middle attack
| Package(s): | smack | CVE #(s): | CVE-2014-5075 | ||||||||
| Created: | September 2, 2014 | Updated: | September 4, 2014 | ||||||||
| Description: | From the Bugtrac advisory:
Smack prior to version 4.0.2 is vulnerable to TLS Man-in-the-Middle attacks, as it fails to check if the server certificate matches the hostname of the connection. Smack is using Java's `SSLSocket`, which checks the peer certificate using an `X509TrustManager`, but does not perform hostname verification. Therefore, it is possible to redirect the traffic between a Smack-using application and a legitimate XMPP server through the attacker's server, merely by providing a valid certificate for a domain under the attacker's control. In Smack versions 2.2.0 to 3.4.1, a custom `ServerTrustManager` implementation was used, which was supplied with the connection's server name, and performed hostname verification. However, it failed to verify the basicConstraints and nameConstraints of the certificate chain (CVE-2014-0363) and has been removed in Smack 4.0.0. Applications using Smack 2.2.0 to 3.4.1 with a custom `TrustManager` did not benefit from `ServerTrustManager` and are vulnerable as well, unless their own `TrustManager` implementation explicitly performs hostname verification. | ||||||||||
| Alerts: |
| ||||||||||
springframework-security: access control restrictions bypass
| Package(s): | springframework-security | CVE #(s): | CVE-2014-3527 | ||||||||
| Created: | September 2, 2014 | Updated: | September 4, 2014 | ||||||||
| Description: | From the Red Hat bugzilla:
When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. A remote attacker could use this flaw to bypass any access control restrictions on which CAS services can authenticate to one another. | ||||||||||
| Alerts: |
| ||||||||||
squid3: denial of service
| Package(s): | squid3 | CVE #(s): | CVE-2014-3609 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | August 28, 2014 | Updated: | May 1, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
zarafa: multiple vulnerabilities
| Package(s): | zarafa | CVE #(s): | CVE-2014-5447 CVE-2014-5448 CVE-2014-5449 CVE-2014-5450 | ||||||||||||||||
| Created: | September 2, 2014 | Updated: | September 4, 2014 | ||||||||||||||||
| Description: | From the oss-sec advisory:
Robert Scheck discovered that the Zarafa Collaboration Platform has multiple incorrect default permissions (CWE-276): 1. In order to fix CVE-2014-0103, Zarafa introduced constants PASSWORD_KEY and PASSWORD_IV in /etc/zarafa/webaccess-ajax/config.php (Zarafa WebAccess) and /etc/zarafa/webapp/config.php (Zarafa WebApp), both are the upstream path names of a default installation, downstream names might be different. Both files have default permissions of root:root and 644, thus decryption of the symmetric encrypted passwords in the on-disk PHP session files is possible again (similar like initially described in CVE-2014-0103). Affects Zarafa WebAccess >= 7.1.10, Zarafa WebApp >= 1.6 beta. 2. The log directory /var/log/zarafa/ is shipped by default with root:root and 755 and all created log files by the Zarafa daemons have by default root:root and 644. This is leaking (depending on the log level of the given service) only e.g. subject, sender/recipient, message-id, SMTP queue id of in- and outbound e-mails but might be even a cleartext protocol dump of IMAP, POP3, CalDAV and iCal as well (including possible credentials) to any local system user. Affects Zarafa >= 5.00. 3. The directories /var/lib/zarafa-webaccess/tmp/ (Zarafa WebAccess) and /var/lib/zarafa-webapp/tmp/ (Zarafa WebApp) are read- and writable by the Apache system user by default - but also world readable for local system users (e.g. apache:apache and 755 on RHEL). Thus all the temporary session data such as uploaded e-mail attachments can be read-only accessed because all created files below previously mentioned directories have permissions 644, too. Upstream path names changed over the time and releases. Affects Zarafa WebAccess >= 4.1, Zarafa WebApp (any version). 4. The optional (but proprietary) license daemon /usr/bin/zarafa-licensed runs by default with root permissions, the subscription/license key is put into '/etc/zarafa/license/*'. The license files are recommended (according upstream documentation) to be created using echo(1) which usually leads to root:root and 644. But the parent directory /etc/zarafa/license/ is shipped by default with root:root and 755. As result the key files can be accessed and copied by any local system user. Affects Zarafa >= 4.1. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>