Security
Encryption, the NSA, and the front door
There are few topics these days that can spark debate in software-development circles as quickly as the US National Security Agency (NSA). Recently, the NSA's director went on the record in public to advocate mandating government access to encrypted software systems. Such mandatory access is an idea that has been floated before, and although this time around the specifics are different, the tech industry has been just as receptive to the potential interference as one would expect. The plan outlined would make it virtually impossible to deploy certain free-software systems without running afoul of regulations and, while it does not seem particularly likely to be written into law any time soon, is has provoked quite a bit of discussion.
NSA Director Michael Rogers made the comments in question during a
speech at Princeton University. The Washington Post published
a write-up of the talk on April 10. The story quotes Rogers as saying
"I don’t want a back door [...] I want a front door. And I want
the front door to have multiple locks. Big locks.
" The
distinction Rogers made was that "back doors" are hidden entry points;
what he promoted are encryption systems with strong crypto—but where law enforcement has a way to access the keys.
The comments come while the White House is studying encryption
policy, the Post story explains. In a February interview
with Re/code, President Obama said " All of this, of course, is familiar territory. A service provider
(such as an email-hosting service) might be asked to turn over the
emails and access logs associated with a particular user account. If
all of the encryption keys needed to decrypt the account information
are held by the user, the service provider cannot turn over any
readable documents. What is different, however, is Rogers's
suggestion.
For reference, in the mid-1990s the Clinton administration proposed a mandatory
"key escrow" system, in which service providers would be required to
create decryption keys independent of any keys held by the
user or the service provider. Those keys would be turned over
to a "trusted party" that would, in turn, release the appropriate key to
the US government when required during criminal investigations. The
proposal was an extension of the Clipper chip
project, which was a hardware-based encryption system for digital
phones. Each chip had a backdoor encryption key burned in during the
manufacturing process; the backdoor key was held by the government.
The Clipper chip failed in the marketplace, however, and was quickly
abandoned.
The Wikipedia entry on key escrow
links to a copy
[PDF] of the 1996 CIA memo advocating a post-Clipper-chip escrow
program. It makes for interesting historical reading, but the program
was never implemented. The objections to it (apart from the risk
driving software development away from the US) were straightforward: fear of abuse by government
agencies or individuals, fear of abuse by the "trusted parties," and
the general principle that individuals deserve to keep some of their
communication private.
What Rogers proposed this time is a "split key" system. As with key escrow,
an encryption key independent of the user's would be generated for
each account—but in this system each of those keys would then be
split into parts. The government would hold one half, and the service provider the
other. Both pieces would have to be brought together to access a user
account. That way, no single rogue actor could access a user's private
data—regardless of whether the actor was from law enforcement or
from the service provider.
The Post story cites critics of the proposal from Yahoo and from George
Washington University’s Cyberspace Security Policy and Research
Institute. There would be technological and logistical challenges to
a mandatory form of such a system—imagine how many split keys would
need to be generated and delivered to law enforcement on a daily basis
for services as popular as Gmail and Facebook, for instance.
There is also the problem of keeping the split keys separate. Even
if they are held by separate entities in the long term, they must be
generated together and then distributed. That provides an opportunity
for an attacker to copy both keys well before they reach the proper
hands (including, of course, the service keeping its own copy of the
government key from day one). Similarly, any time both key halves are
used together, there would be another opportunity to steal or duplicate them.
In addition, critics of US government security policy may
understandably have questions about how the government would
exercise its right to meet with the service provider and access a
suspicious account. Would such meetings be subject to gag orders or
secret National Security Letters?
Would the government be able to compel the service to turn over its
half of the key, if it decided the stakes were particularly high?
Furthermore, under such a plan it might become illegal in the US
to run non-compliant Internet services (possibly even for private
use), which would put untold numbers of free-software projects in a bind. They
would have to choose between implementing the mandatory split-key
escrow service and losing US users. Free-software projects not based
in the US would hardly be expected to merge in support for a
US-government access program. No doubt some users in the US would
continue to run their own services as they see fit, but they would do
so at significant legal risk.
The Post story notes that, so far, there is no legislation proposed
to implement what Rogers is asking for. It would seem to be a hard
sell in the current climate; after the Edward Snowden leaks,
cooperating with the NSA is a decidedly unpopular proposition in tech circles, and
consumer interest in privacy issues is relatively high.
Nevertheless, privacy advocates are not taking anything for
granted. The Electronic Frontier Foundation (EFF) criticized
Rogers's comments, casting them in the same light as the Clipper chip
and related proposals:
On the plus side, the EFF article is a welcome reminder that past
attempts to mandate back (or front) doors in encryption products have
failed. Historians will note that the Clipper chip fiasco contributed
considerably to the growth of PGP and other software encryption
projects, even though at that time encryption was considered
"munitions" and was subject to export controls.
Whatever comes of
the NSA's interest in split-key escrow technology, it will no doubt
provoke considerable work from privacy-conscious software
developers—perhaps leading to projects that will have just as
much impact in the long term as PGP.
there’s no scenario in which
we don’t want really strong encryption
", but went on to say that
law enforcement has a national-security interest in accessing
encrypted communication. The difficulty, he said, is that encryption
that is too strong makes it impossible for a software company to
comply with a court order requesting specific documents.
Brief items
Security quote of the week
But to me, the fascinating part of this story is that a computer was monitoring the Twitter feed and understood the obscure references, alerted a person who figured out who wrote them, researched what flight he was on, and sent an FBI team to the Syracuse airport within a couple of hours. There's some serious surveillance going on.
Now, it is possible that Roberts was being specifically monitored. He is already known as a security researcher who is working on avionics hacking. But still...
How Tor is building a new Dark Net with help from the U.S. military (The Daily Dot)
The Daily Dot reports that the Tor project is receiving some funding from the US Defense Advanced Research Projects Agency (DARPA) to improve Tor's hidden services. "The Dark Net road map moving forward is ambitious. Tor plans to double the encryption strength of hidden service’s identity key and to allow offline storage for that key, a major security upgrade. Next-generation hidden services may be run from multiple hosts to better deal with denial of service attacks and high traffic in general, a potentially big power boost that further closes the gap between the Dark Net and normal websites."
New vulnerabilities
ceph-deploy: information leak
| Package(s): | ceph-deploy | CVE #(s): | CVE-2015-3010 | ||||
| Created: | April 22, 2015 | Updated: | April 22, 2015 | ||||
| Description: | From the Red Hat bugzilla:
ceph-deploy versions before 1.5.23 had an issue where keyring permissions were world readable. | ||||||
| Alerts: |
| ||||||
chromium: multiple vulnerabilities
| Package(s): | chromium | CVE #(s): | CVE-2015-3333 CVE-2015-3334 CVE-2015-3335 CVE-2015-3336 | ||||||||||||||||
| Created: | April 22, 2015 | Updated: | April 28, 2015 | ||||||||||||||||
| Description: | From the CVE entries:
Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. (CVE-2015-3333) browser/ui/website_settings/website_settings.cc in Google Chrome before 42.0.2311.90 does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site, which might make it easier for user-assisted remote attackers to obtain sensitive video data from a device's physical environment via a crafted web site that turns on the camera at a time when the user believes that camera access is prohibited. (CVE-2015-3334) The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox. (CVE-2015-3335) Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes, which allows user-assisted remote attackers to cause a denial of service (UI disruption) by constructing a crafted HTML document containing JavaScript code with requestFullScreen and requestPointerLock calls, and arranging for the user to access this document with a file: URL. (CVE-2015-3336) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
chromium: multiple vulnerabilities
| Package(s): | chromium-browser | CVE #(s): | CVE-2015-1235 CVE-2015-1236 CVE-2015-1237 CVE-2015-1238 CVE-2015-1240 CVE-2015-1241 CVE-2015-1242 CVE-2015-1244 CVE-2015-1245 CVE-2015-1246 CVE-2015-1247 CVE-2015-1248 CVE-2015-1249 | ||||||||||||||||||||||||||||||||
| Created: | April 16, 2015 | Updated: | April 28, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Bugs fixed (https://bugzilla.redhat.com/):
| ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
curl: multiple vulnerabilities
| Package(s): | curl | CVE #(s): | CVE-2015-3143 CVE-2015-3144 CVE-2015-3145 CVE-2015-3148 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 22, 2015 | Updated: | May 4, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
CVE-2015-3143: NTLM-authenticated connections could be wrongly reused for requests without any credentials set, leading to HTTP requests being sent over the connection authenticated as a different user. This is similar to the issue fixed in DSA-2849-1. CVE-2015-3144: When parsing URLs with a zero-length hostname (such as "http://:80"), libcurl would try to read from an invalid memory address. This could allow remote attackers to cause a denial of service (crash). This issue only affects the upcoming stable (jessie) and unstable (sid) distributions. CVE-2015-3145: When parsing HTTP cookies, if the parsed cookie's "path" element consists of a single double-quote, libcurl would try to write to an invalid heap memory address. This could allow remote attackers to cause a denial of service (crash). This issue only affects the upcoming stable (jessie) and unstable (sid) distributions. CVE-2015-3148: When doing HTTP requests using the Negotiate authentication method along with NTLM, the connection used would not be marked as authenticated, making it possible to reuse it and send requests for one user over the connection authenticated as a different user. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
django-markupfield: information leak
| Package(s): | django-markupfield | CVE #(s): | CVE-2015-0846 | ||||||||
| Created: | April 20, 2015 | Updated: | April 22, 2015 | ||||||||
| Description: | From the Debian advisory:
James P. Turk discovered that the ReST renderer in django-markupfield, a custom Django field for easy use of markup in text fields, didn't disable the ..raw directive, allowing remote attackers to include arbitrary files. | ||||||||||
| Alerts: |
| ||||||||||
firefox: code execution
| Package(s): | firefox | CVE #(s): | CVE-2015-2706 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 22, 2015 | Updated: | May 14, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
Mozilla developer Robert Kaiser reported that a specially crafted HTML, when loaded by the target user, will trigger a use-after-free race condition when a plugin fails to initialize, which may lead to a memory corruption error in AsyncPaintWaitEvent::AsyncPaintWaitEvent() and arbitrary code execution on the target system. A remote attacker is able to use a specially crafted HTML that, when loaded by the target user, will trigger a race condition leading to memory corruption and arbitrary code execution. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
glibc: code execution
| Package(s): | glibc | CVE #(s): | CVE-2015-1781 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 21, 2015 | Updated: | May 28, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
gnupg2: double-free issue
| Package(s): | gnupg2 | CVE #(s): | |||||
| Created: | April 20, 2015 | Updated: | April 22, 2015 | ||||
| Description: | From the Red Hat bugzilla:
Double-free issue was reported in gnupg2: in scd/command.c 'cert' is freed twice on ksba_cert_new() failure:
...
778 rc = ksba_cert_new (&kc);
779 if (rc)
780 {
781 xfree (cert);
782 goto leave;
783 }
...
803 leave:
804 ksba_cert_release (kc);
805 xfree (cert);
| ||||||
| Alerts: |
| ||||||
groovy-sandbox: privilege escalation
| Package(s): | groovy-sandbox | CVE #(s): | CVE-2015-1806 | ||||||||||||||||||||||||
| Created: | April 20, 2015 | Updated: | April 22, 2015 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
gst-plugins-bad: code execution
| Package(s): | gst-plugins-bad0.10 | CVE #(s): | CVE-2015-0797 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 16, 2015 | Updated: | December 30, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Aki Helin discovered a buffer overflow in the GStreamer plugin for MP4 playback, which could lead in the execution of arbitrary code. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2014-8171 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 21, 2015 | Updated: | April 22, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was found that the Linux kernel memory resource controller's (memcg) handling of OOM (out of memory) conditions could lead to deadlocks. An attacker able to continuously spawn new processes within a single memory-constrained cgroup during an OOM event could use this flaw to lock up the system. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
knot: multiple vulnerabilities
| Package(s): | knot | CVE #(s): | |||||||||
| Created: | April 20, 2015 | Updated: | April 22, 2015 | ||||||||
| Description: | From the Fedora advisory: - new upstream release:
| ||||||||||
| Alerts: |
| ||||||||||
java: sandbox bypass
| Package(s): | java-1.8.0-openjdk | CVE #(s): | CVE-2015-0470 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 16, 2015 | Updated: | April 22, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Multiple flaws were discovered in the Beans and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2015-0477, CVE-2015-0470) | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
java: multiple unspecified vulnerabilities
| Package(s): | java-1.8.0-oracle | CVE #(s): | CVE-2015-0458 CVE-2015-0459 CVE-2015-0484 CVE-2015-0486 CVE-2015-0491 CVE-2015-0492 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 17, 2015 | Updated: | January 14, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries: CVE-2015-0458 - Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. CVE-2015-0459 - Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491. CVE-2015-0484 - Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0492. CVE-2015-0486 - Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. CVE-2015-0491 - Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459. CVE-2015-0492 - Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
jenkins: multiple vulnerabilities
| Package(s): | jenkins | CVE #(s): | CVE-2015-1807 CVE-2015-1813 CVE-2015-1812 CVE-2015-1810 CVE-2015-1808 CVE-2015-1809 CVE-2015-1814 CVE-2015-1811 | ||||||||||||
| Created: | April 20, 2015 | Updated: | April 22, 2015 | ||||||||||||
| Description: | From the Red Hat bugzilla entries:
CVE-2015-1812, CVE-2015-1813: An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker. CVE-2015-1814: The part of Jenkins that issues a new API token was not adequately protected against anonymous attackers. This allows an attacker to escalate privileges on Jenkins. CVE-2015-1807: This vulnerability allows users with the job configuration privilege or users with commit access to the build script to access arbitrary files/directories on the master, resulting in the exposure of sensitive information, such as encryption keys. CVE-2015-1808: This vulnerability allows authenticated users to disrupt the operation of Jenkins by feeding malicious update center data into Jenkins, affecting plugin installation and tool installation. CVE-2015-1809: This vulnerability allows users with the read access to Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins. CVE-2015-1810: For users using "'Jenkins' own user database" setting, Jenkins doesn't refuse reserved names, thus allowing privilege escalation. CVE-2015-1811: This vulnerability allows attackers to create malicious XML documents and feed that into Jenkins, which causes Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins. | ||||||||||||||
| Alerts: |
| ||||||||||||||
mariadb: two unspecified vulnerabilities
| Package(s): | mariadb | CVE #(s): | CVE-2014-6474 CVE-2014-6489 | ||||||||
| Created: | April 22, 2015 | Updated: | August 20, 2015 | ||||||||
| Description: | From the CVE entries:
Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:MEMCACHED. (CVE-2014-6474) Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect integrity and availability via vectors related to SERVER:SP. (CVE-2014-6489) | ||||||||||
| Alerts: |
| ||||||||||
mediawiki: cross-site scripting
| Package(s): | mediawiki | CVE #(s): | CVE-2014-9714 | ||||||||
| Created: | April 20, 2015 | Updated: | April 22, 2015 | ||||||||
| Description: | From the CVE entry:
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function. (CVE-2014-9714) | ||||||||||
| Alerts: |
| ||||||||||
movabletype-opensource: code execution
| Package(s): | movabletype-opensource | CVE #(s): | CVE-2015-0845 | ||||
| Created: | April 16, 2015 | Updated: | April 22, 2015 | ||||
| Description: | From the Debian advisory:
John Lightsey discovered a format string injection vulnerability in the localisation of templates in Movable Type, a blogging system. An unauthenticated remote attacker could take advantage of this flaw to execute arbitrary code as the web server user. | ||||||
| Alerts: |
| ||||||
MySQL: multiple unspecified vulnerabilities
| Package(s): | mysql-5.5 | CVE #(s): | CVE-2015-0433 CVE-2015-0441 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 20, 2015 | Updated: | July 10, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML. (CVE-2015-0433) Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption. (CVE-2015-0441) Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated. (CVE-2015-0499) Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. (CVE-2015-0501) Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. (CVE-2015-0505) Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges. (CVE-2015-2568) Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. (CVE-2015-2571) Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. (CVE-2015-2573) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
ntop: cross-site-scripting
| Package(s): | ntop | CVE #(s): | CVE-2014-4165 | ||||||||||||
| Created: | April 17, 2015 | Updated: | April 29, 2015 | ||||||||||||
| Description: | From the openSUSE advisory: Lack of filtering in the title parameter of links to rrdPlugin allowed cross-site-scripting (XSS) attacks against users of the web interface. | ||||||||||||||
| Alerts: |
| ||||||||||||||
openstack-nova: multiple vulnerabilities
| Package(s): | openstack-nova | CVE #(s): | CVE-2014-3708 CVE-2014-8333 | ||||||||
| Created: | April 17, 2015 | Updated: | April 22, 2015 | ||||||||
| Description: | From the Red Hat advisory: A denial of service flaw was found in the way OpenStack Compute (nova) looked up VM instances based on an IP address filter. An attacker with sufficient privileges on an OpenStack installation with a large amount of VMs could use this flaw to cause the main nova process to block for an extended amount of time. (CVE-2014-3708) A flaw was found in the OpenStack Compute (nova) VMWare driver, which could allow an authenticated user to delete an instance while it was in the resize state, causing the instance to remain on the back end. A malicious user could use this flaw to cause a denial of service by exhausting all available resources on the system. (CVE-2014-8333) | ||||||||||
| Alerts: |
| ||||||||||
openstack-swift: metadata constraint bypass
| Package(s): | openstack-swift | CVE #(s): | CVE-2014-7960 | ||||||||||||||||
| Created: | April 17, 2015 | Updated: | August 6, 2015 | ||||||||||||||||
| Description: | From the Red Hat advisory: A flaw was found in the metadata constraints in OpenStack Object Storage (swift). By adding metadata in several separate calls, a malicious user could bypass the max_meta_count constraint, and store more metadata than allowed by the configuration. (CVE-2014-7960) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
perl-Module-Signature: multiple vulnerabilities
| Package(s): | perl-Module-Signature | CVE #(s): | |||||||||||||||||||||||||
| Created: | April 20, 2015 | Updated: | April 27, 2015 | ||||||||||||||||||||||||
| Description: | From the Fedora advisory:
* Module::Signature before version 0.75 could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries. * When verifying the contents of a CPAN module, Module::Signature before version 0.75 ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute automatically during "make test". * Module::Signature before version 0.75 used two argument open() calls to read the files when generating checksums from the signed manifest. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process. * Module::Signature before version 0.75 has been loading several modules at runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious module so that they would load from the '.' path in @INC. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
php: information disclosure
| Package(s): | php | CVE #(s): | CVE-2015-2783 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 17, 2015 | Updated: | June 25, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory: The vulnerability can be triggered when parsing a PHAR file at phar.c:623. The "buf_len" is obtained from the phar file and passed into php_var_unserialize() as the max argument. Under normal php_var_unserialize() circumstances, YYCURSOR will always be <= max. This however can be bypassed when processing a malform phar with a buf_len that is shorter then the string to be unserialized resulting in a memory info leak. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
php5: code execution
| Package(s): | php5 | CVE #(s): | CVE-2015-3330 CVE-2015-3329 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 21, 2015 | Updated: | June 25, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
It was discovered that PHP incorrectly handled cleanup when used with Apache 2.4. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-3330) It was discovered that PHP incorrectly handled opening tar, zip or phar archives through the PHAR extension. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-3329) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
php-symfony: two vulnerabilities
| Package(s): | php-symfony | CVE #(s): | CVE-2015-2308 CVE-2015-2309 | ||||||||
| Created: | April 20, 2015 | Updated: | April 22, 2015 | ||||||||
| Description: | From the Fedora advisory:
- Update to 2.5.11 - security fix for CVE-2015-2308 and CVE-2015-2309 | ||||||||||
| Alerts: |
| ||||||||||
postgis: multiple unspecified vulnerabilities
| Package(s): | postgis | CVE #(s): | |||||||||
| Created: | April 20, 2015 | Updated: | May 12, 2015 | ||||||||
| Description: | There are evidently security fixes in this list from the PostGIS 2.1.6 release announcement:
Bug Fixes
| ||||||||||
| Alerts: |
| ||||||||||
ppp: denial of service
| Package(s): | ppp | CVE #(s): | CVE-2015-3310 | ||||||||||||||||||||||||||||||||||||
| Created: | April 16, 2015 | Updated: | January 23, 2017 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Emanuele Rocca discovered that ppp, a daemon implementing the Point-to-Point Protocol, was subject to a buffer overflow when communicating with a RADIUS server. This would allow unauthenticated users to cause a denial-of-service by crashing the daemon. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
proftpd: unauthenticated copying of files
| Package(s): | proftpd | CVE #(s): | CVE-2015-3306 | ||||||||||||||||||||
| Created: | April 22, 2015 | Updated: | May 20, 2015 | ||||||||||||||||||||
| Description: | From the Slackware advisory:
Patched an issue where mod_copy allowed unauthenticated copying of files via SITE CPFR/CPTO. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
python-virtualenv: insecure software download
| Package(s): | python-virtualenv | CVE #(s): | CVE-2013-5123 | ||||||||||||
| Created: | April 22, 2015 | Updated: | April 22, 2015 | ||||||||||||
| Description: | From the Red Hat bugzilla:
The mirroring support (-M, --use-mirrors) was implemented without any sort of authenticity checks and is downloaded over plaintext HTTP. Further more by default it will dynamically discover the list of available mirrors by querying a DNS entry and extrapolating from that data. It does not attempt to use any sort of method of securing this querying of the DNS like DNSSEC. Software packages are downloaded over these insecure links, unpacked, and then typically the setup.py python file inside of them is executed. | ||||||||||||||
| Alerts: |
| ||||||||||||||
qt: multiple vulnerabilities
| Package(s): | qt | CVE #(s): | CVE-2015-1858 CVE-2015-1859 CVE-2015-1860 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 22, 2015 | Updated: | March 14, 2016 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Slackware advisory:
Fixed issues with BMP, ICO, and GIF handling that could lead to a denial of service or the execution of arbitrary code when processing malformed images. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
rest: denial of service
| Package(s): | rest | CVE #(s): | CVE-2015-2675 | ||||||||||||||||||||
| Created: | April 20, 2015 | Updated: | December 22, 2015 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was reported that the OAuth implementation in librest, a helper library for RESTful services part of the GNOME project, incorrectly truncates the pointer returned by the rest_proxy_call_get_url function call, leading to an application crash, or worse. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
rubygem-rest-client: plaintext password logging
| Package(s): | rubygem-rest-client | CVE #(s): | CVE-2015-3448 | ||||||||
| Created: | April 16, 2015 | Updated: | May 18, 2015 | ||||||||
| Description: | From the SUSE bugzilla entry:
REST Client for Ruby contains a flaw that is due to the application logging password information in plaintext. This may allow a local attacker to gain access to password information. | ||||||||||
| Alerts: |
| ||||||||||
tcpdump: denial of service
| Package(s): | tcpdump | CVE #(s): | CVE-2015-3138 | ||||
| Created: | April 21, 2015 | Updated: | April 22, 2015 | ||||
| Description: | From the Arch Linux advisory:
A vulnerability was discovered in print-wb.c that is leading to a segmentation fault triggered through feeding into tcpdump a crafted packet, either from a live network interface or from a .pcap file. A remote attacker is able to send specially crafted packets to cause a segmentation fault leading to denial of service. | ||||||
| Alerts: |
| ||||||
Page editor: Jake Edge
Next page:
Kernel development>>