Security
A verifiable source of random numbers
High-quality entropy is vital for cryptography (among other functions), but adequate sources for it are hard to come by on standard computer hardware. Entropy sources that can be verified as trustworthy are even rarer. At linux.conf.au 2015 in Auckland, Jim Cheetham and Paul Campbell presented a session about OneRNG, their new hardware random number generator (RNG). OneRNG rapidly produces random bits that can be fed into the kernel's entropy pool, but it also offers protection against various security attacks: users can independently verify the integrity of all software, firmware, and hardware components.
![[Paul Campbell and Jim Cheetham]](https://static.lwn.net/images/2015/01-lca-onerng-sm.jpg "Paul Campbell and Jim Cheetham")
Cheetham started off the talk with a background discussion about random number generation and explained the approach taken by the OneRNG—both how its random numbers are generated, and how they are provided to Linux. A true random number generator is critical, he said. Most of the alleged sources for entropy on a computer—such as network-traffic and hard-disk timing—are not as random as we would like them to be and can even be subject to sophisticated attacks. Furthermore, even a cryptographically secure pseudo-random number generator (CSPRNG) requires true random numbers as seed values.
The OneRNG's primary entropy source is an avalanche diode circuit that generates quantum noise, sampled in the analog domain. The same circuit has been used in other RNGs. This, he said, is one of just a few options for "physics that we cannot predict yet." A second entropy source is also present in the device: a de-tuned radio-frequency (RF) receiver chip that frequency hops at random intervals. Cheetham explained that it is theoretically possible for an attacker to skew the output of the RF receiver circuit by transmitting powerful RF signals, so the receiver is disabled by default. But it is available for users who wish to use it and are prepared to deal with the potential attacks; if properly used it can provide even better entropy than the avalanche diode.
There is also an AES chip present in the integrated circuit, but it is not used by the OneRNG at all because the integrity of its output cannot be independently validated. The issue, he explained, is that it remains conceivable that the US National Security Agency (NSA) or other powerful players have broken AES without anyone else knowing it.
The output of the avalanche circuit (as well as that of the RF receiver, if enabled) is run through a "whitening" CRC16 hash function before it is delivered to the RNG daemon, rngd. A separate rngd process is started for each OneRNG device plugged into a given system, and each rngd process is terminated when the device is unplugged. Each rngd daemon stirs its device's output into the kernel's entropy pool, which is accessible through the usual means: /dev/random and /dev/urandom.
The original goal of OneRNG, the speakers explained, was cryptography, which is "incredibly hungry" for entropy, and also incredibly sensitive. Android's pseudorandom number generator only had a tiny flaw, Cheetham noted, but that was enough for an exploit to rob people of Bitcoins ("note that I'm not saying they lost money," Cheetham quipped, "just Bitcoins."). But, he continued, there are several other important uses for RNGs—most notably scientific research that relies on numerical simulations and the online gambling industry, which has to prove to government regulators that it runs unbiased "games."
Design and verification
Campbell then took center stage, explaining the circuit design and the decisions that went into making the device something that users can audit. All of the software and firmware is open source and publicly available, of course, as are the schematics and board layouts. In addition, Campbell took pains to make the circuitry as simple as possible, so that its functionality is simpler to verify. There is only one "dense block" involved—the CC2531 CPU—and it was chosen because it is an older device available from many sources.
The same chip is also found in many older remote controls; if users are worried about the integrity of the CPU, he added "ask yourself if the NSA compromised this usage—of this chip—five years before this usage was invented." The truly paranoid, he said, can replace the CPU shipped on the device with another one that they acquire themselves.
The firmware included on the OneRNG is signed; users can dump it to a file, verify the signature, and verify that the firmware dump is exactly 256K. In fact, the actual firmware needed by the device is less than 256K; the team padded out the rest of the 256K size (with random data) to prevent attackers from adding an additional payload.
The device's operation can also be double-checked, Campbell said. "Don't trust me to write good code: lift the lid and check." In particular, the whitening function can be disabled, so that users can test the raw avalanche-circuit output. An audience member asked why the whitening step was included at all, given that the circuit is designed to produce true random numbers. Campbell replied that there is a slight DC bias to the entropy as generated by the circuit, so it generates about 5% more ones than zeros.
Due to that bias, the kernel may complain about the quality of the results. Whitening the output removes that obstacle at no additional cost. Correcting the DC bias in hardware would raise the per-unit price to $10,000, he said. As is, the end result is approximately 7.5 bits of entropy per byte, which can be stirred in with other entropy sources to further improve the quality level. The OneRNG is advertised as generating 350Kbps of entropy, Campbell said, although his tests generally show an even better performance (closer to 500Kbps).
Finally, although the OneRNG device is a USB stick, programming the device must be done with a special hardware tool (also open hardware). The OneRNG is not programmable through its USB port, in order to guard against attackers modifying the firmware.
Users should therefore be able to examine the physical circuitry, the firmware, the raw output, and all of the software used to support the OneRNG, verifying that each piece has not been tampered with. Startup scripts should perform the firmware and software verification every time a OneRNG is plugged in. Nevertheless, Campbell said, he advised that all users take the precaution of using multiple hardware RNGs: in addition to the OneRNG, he pointed to Paul Warren's rtl-entropy, Keith Packard and Bdale Garbee's USBtrng, John Denker's Turbid, and Yutaka Niibe's NeuG as other projects to consider.
Funding and further development
OneRNG is intended to be a low-cost tool. After making the first few prototypes, Campbell and Cheetham launched a fundraiser on Kickstarter. The project reached its 100% funding level in just six days (and, in fact, was still running with nearly two weeks left at the time of the talk). Campbell estimated that the total was on track to hit $32,000 (more than triple the target), which he called "really amazing." Since their talk, the total has exceeded that prediction. With more funds available than initially expected, Campbell said he was working on building device programmers with which users can build and upload their own firmware, and has ideas for other stretch goals (at least one of which, an internal version of the device for servers, has since been announced).
The two also discussed a few of the project's ongoing challenges. One is that building a serial-over-USB device like the OneRNG proves to be tricky because ModemManager assumes the device to be a modem and tries to take it over. From the audience, Packard asked why the team doesn't simply make the hardware appear as some other device type; Campbell replied that producing the numbers over a serial port was important because it would enable users on any (i.e. non-Linux) operating system use it as well.
Campbell also reported that it was tricky to start the firmware-verification script, followed by launching the rngd process, in a way that integrated smoothly with Linux init systems. Thus, the project starts the daemon using an at command instead. Finally, he noted that when unplugging the OneRNG it can be easy for udev to get "confused" about which device was removed. "Apparently, no one uses udev removal scripts, probably because udev removal is so broken."
There was a brief question-and-answer period at the end of the talk. One audience member asked if the team had any concerns about ordering its chips from China, given that the team had taken so many measures to guard against tampering by the US government. Campbell replied that he always has some concerns, but that in the past he has only had trouble with one chip being replaced with the wrong (but a similar) part. Usually, he added, working closely with the supplier in question prevents those problems—but the OneRNG team also has code prepared to validate all of the chips it receives.
The Kickstarter fundraiser campaign will conclude on January 28. The first, hand-made OneRNG units should be available in March, with the mass-produced units to follow a couple of months later.
[The author would like to thank LCA 2015 for travel assistance to Auckland.]
Brief items
Security quotes of the week
NSA agents aren't concerned about being caught. That's partly because they work for such a powerful agency, but also because they don't leave behind any evidence that would hold up in court. And if there is no evidence of wrongdoing, there can be no legal penalty, no parliamentary control of intelligence agencies and no international agreement.
The tone of these leaks is jubilant, almost giddy, filled with jokey pop-culture references. Countries targeted for fourth-party collection include US/Five Eyes allies, like Germany, whose spy-services have been penetrated by the NSA.
We've all come to expect the "government owns your communications" propaganda from Putin and his ilk.
To hear the same sort of twisted reasoning -- no matter how candy coated or sprinkled with excuses -- flinging forth from our Western leaders is disheartening in the extreme, and must not be accepted without vigorous challenge, debate, and due consideration for the enormous damage such proposals could easily wreak on us all.
New vulnerabilities
coreutils: code execution
| Package(s): | coreutils | CVE #(s): | CVE-2014-9471 | ||||||||||||||||
| Created: | January 15, 2015 | Updated: | December 8, 2016 | ||||||||||||||||
| Description: | From the Ubuntu advisory:
Bertrand Jacquin and Fiedler Roman discovered date and touch incorrectly handled user-supplied input. An attacker could possibly use this to cause a denial of service or potentially execute code. (CVE-2014-9471) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
elfutils: directory traversal
| Package(s): | elfutils | CVE #(s): | CVE-2014-9447 | ||||||||||||||||||||||||||||||||||||
| Created: | January 19, 2015 | Updated: | July 29, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
file: denial of service
| Package(s): | file | CVE #(s): | CVE-2014-9620 CVE-2014-9621 | ||||||||||||||||||||||||||||||||
| Created: | January 20, 2015 | Updated: | January 21, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory
Alexander Cherepanov reported that using the file command on a specially-crafted ELF binary could lead to a denial of service due to uncontrolled resource consumption while processing ELF section headers (CVE-2014-9620, CVE-2014-9621). | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
firefox: multiple vulnerabilities
| Package(s): | firefox | CVE #(s): | CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8640 CVE-2014-8642 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 15, 2015 | Updated: | January 21, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635) Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636) Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637) Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640) Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
gparted: code execution
| Package(s): | gparted | CVE #(s): | CVE-2014-7208 | ||||
| Created: | January 15, 2015 | Updated: | January 21, 2015 | ||||
| Description: | From the Ubuntu advisory:
Wolfgang Ettlinger discovered that GParted incorrectly filtered shell metacharacters when running external commands. A local attacker could use this issue with a crafted filesystem label to run arbitrary commands as the administrator. | ||||||
| Alerts: |
| ||||||
ia32-libs: multiple vulnerabilities
| Package(s): | ia32-libs, ia32-libs-gtk | CVE #(s): | |||||||||||||
| Created: | January 19, 2015 | Updated: | August 5, 2015 | ||||||||||||
| Description: | From the Debian LTS report:
The ia32-libs and ia32-libs-gtk packages contain 32 bit versions of various libraries for use on 64 bit systems. This update rolls in all security fixes made to these libraries since the previous update of ia32-libs and ia32-libs-gtk in Squeeze LTS. | ||||||||||||||
| Alerts: |
| ||||||||||||||
java: multiple vulnerabilities
| Package(s): | java-1.8.0-openjdk | CVE #(s): | CVE-2014-6549 CVE-2015-0437 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 21, 2015 | Updated: | January 22, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Scientific Linux advisory:
Multiple improper permission check issues were discovered in the JAX-WS, Libraries, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-6549) Multiple flaws were found in the way the Hotspot component in OpenJDK verified bytecode from the class files, and in the way this component generated code for bytecode. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions. (CVE-2015-0437) | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
java: multiple vulnerabilities
| Package(s): | java-1.7.0-openjdk, java-1.8.0-openjdk | CVE #(s): | CVE-2015-0383 CVE-2014-6601 CVE-2015-0412 CVE-2015-0408 CVE-2015-0395 CVE-2015-0407 CVE-2015-0410 CVE-2014-6593 CVE-2014-6585 CVE-2014-6591 CVE-2014-6587 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 21, 2015 | Updated: | May 28, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Scientific Linux advisory:
A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2014-6601) Multiple improper permission check issues were discovered in the JAX-WS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412, CVE-2015-0408) A flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions. (CVE-2015-0395) A flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. (CVE-2015-0410) A flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the- middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. (CVE-2014-3566) It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. (CVE-2014-6593) An information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0407) A NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. (CVE-2014-6587) Multiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. (CVE-2014-6585, CVE-2014-6591) Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. (CVE-2015-0383) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: information leak
| Package(s): | kernel | CVE #(s): | CVE-2014-9584 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 15, 2015 | Updated: | January 21, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
CVE-2014-9584: It was found that the Linux kernel does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2010-5313 CVE-2014-9585 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 19, 2015 | Updated: | January 26, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842. (CVE-2010-5313) The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. (CVE-2014-9585) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kde-runtime: misuse of crypto
| Package(s): | kde-runtime | CVE #(s): | CVE-2013-7252 | ||||||||||||||||
| Created: | January 15, 2015 | Updated: | June 28, 2016 | ||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
It was found that kwallet, a tool for managing the passwords on a KDE system, uses Blowfish to encrypt its password store, and despite an attempt at implementing CBC mode (in a file called cbc.cc no less), it's actually ECB mode. UTF-16 encoding combined with Blowfish's 64 bit block size means there are just four password characters per block. Encryption is convergent as well. The risk is that this may enable recovery of passwords through codebook attacks. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
libhtp: denial of service
| Package(s): | libhtp | CVE #(s): | |||||||||||||||||||||||||
| Created: | January 19, 2015 | Updated: | April 10, 2015 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was reported that libhtp handling of streams in error state could lead to NULL pointer dereference, leading to caller crash. Suricata (Intrusion Detection System) embeds libhtp, and is one of the affected components. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libpng16: buffer overflow
| Package(s): | libpng16 | CVE #(s): | CVE-2015-0973 | ||||||||||||||||
| Created: | January 20, 2015 | Updated: | March 9, 2015 | ||||||||||||||||
| Description: | From the SUSE advisory:
A heap-based overflow was found in the png_combine_row() function of the libpng library, when very large interlaced images were used. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
moodle: multiple vulnerabilities
| Package(s): | moodle | CVE #(s): | CVE-2015-0211 CVE-2015-0212 CVE-2015-0213 CVE-2015-0214 CVE-2015-0215 CVE-2015-0217 CVE-2015-0218 | ||||||||
| Created: | January 20, 2015 | Updated: | February 16, 2015 | ||||||||
| Description: | From the Mageia advisory:
In Moodle before 2.6.7, absence of a capability check in AJAX backend script in the LTI module could allow any enrolled user to search the list of registered tools (CVE-2015-0211). In Moodle before 2.6.7, the course summary on course request pending approval page was displayed to the manager unescaped and could be used for XSS attack (CVE-2015-0212). In Moodle before 2.6.7, two files in the Glossary module lacked a session key check potentially allowing cross-site request forgery (CVE-2015-0213). In Moodle before 2.6.7, through web-services it was possible to access messaging-related functions such as people search even if messaging is disabled on the site (CVE-2015-0214). In Moodle before 2.6.7, through web-services it was possible to get information about calendar events which user did not have enough permissions to see (CVE-2015-0215). In Moodle before 2.6.7, non-optimal regular expression in the multimedia filter could be exploited to create extra server load or make particular page unavailable, resulting in a denial of service (CVE-2015-0217). In Moodle before 2.6.7, it was possible to forge a request to logout users even when not authenticated through Shibboleth (CVE-2015-0218). | ||||||||||
| Alerts: |
| ||||||||||
owasp-esapi-java: crypto botch
| Package(s): | owasp-esapi-java | CVE #(s): | CVE-2013-5679 CVE-2013-5960 | ||||||||||||
| Created: | January 15, 2015 | Updated: | February 12, 2015 | ||||||||||||
| Description: | From the Red Hat bugzilla entry:
Owasp-Esapi-Java, a free, open source, web application security control library, was found to have a vulnerability, where it was possible to bypass the authenticity check by setting the MAC length to 0 and the MAC to null, when ESAPI symmetric crypto with CBC mode is used with PKCS#7 padding (called PKCS5Padding in Java), and an HMAC for authenticity. The configuration could result in an exploitable vulnerability depending on the context for encryption and what degree an attacker can tamper with the serialized ciphertext, though only some ESAPI were found to be exploitable when using the default configuration. To be exploitable, an attacker would require the ability to modify ciphertext either at rest or in transit. Because a MAC bypass is possible, authenticity of the ciphertext cannot be guaranteed with the default ESAPI configuration. Consequently, this exposure may allow a successful padding oracle attack against the default ESAPI cryptosystem configuration and hence result in an exploitable vulnerability that could result in a loss of confidentiality or a bypass of the authentication or authorization system. | ||||||||||||||
| Alerts: |
| ||||||||||||||
privoxy: use after free
| Package(s): | privoxy | CVE #(s): | CVE-2015-1031 | ||||||||
| Created: | January 21, 2015 | Updated: | January 21, 2015 | ||||||||
| Description: | From the Debian advisory:
Multiple use-after-frees were discovered in Privoxy, a privacy-enhancing HTTP proxy. | ||||||||||
| Alerts: |
| ||||||||||
samba: privilege escalation
| Package(s): | samba | CVE #(s): | CVE-2014-8143 | ||||||||||||||||||||
| Created: | January 21, 2015 | Updated: | January 23, 2015 | ||||||||||||||||||||
| Description: | From the CVE entry:
Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allows remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
sympa: information disclosure
| Package(s): | sympa | CVE #(s): | CVE-2015-1306 | ||||||||||||||||
| Created: | January 21, 2015 | Updated: | March 3, 2015 | ||||||||||||||||
| Description: | From the Debian advisory:
A vulnerability has been discovered in the web interface of sympa, a mailing list manager. An attacker could take advantage of this flaw in the newsletter posting area, which allows sending to a list, or to oneself, any file located on the server filesystem and readable by the sympa user. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
tomcat6: exception on empty XML attributes
| Package(s): | tomcat6 | CVE #(s): | |||||
| Created: | January 20, 2015 | Updated: | January 21, 2015 | ||||
| Description: | From the Debian LTS advisory:
This update fixes a "NoSuchElementException" when an XML attribute has an empty string as value. | ||||||
| Alerts: |
| ||||||
vsftpd: unauthorized access
| Package(s): | vsftpd | CVE #(s): | CVE-2015-1419 | ||||||||||||||||
| Created: | January 19, 2015 | Updated: | March 11, 2015 | ||||||||||||||||
| Description: | From the SUSE advisory:
The vsftp daemon was not handling the "deny_file" option properly, allowing unauthorized access in some specific scenarios. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
xdg-utils: command execution
| Package(s): | xdg-utils | CVE #(s): | CVE-2014-9622 | ||||||||||||||||||||||||
| Created: | January 19, 2015 | Updated: | January 2, 2017 | ||||||||||||||||||||||||
| Description: | From the Debian advisory:
John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
xen: denial of service
| Package(s): | xen | CVE #(s): | CVE-2015-0361 | ||||||||||||||||||||||||
| Created: | January 19, 2015 | Updated: | January 21, 2015 | ||||||||||||||||||||||||
| Description: | From the CVE entry:
Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>