Security
Security in an error-prone world
The 1957 Chevrolet Bel Air was a beautiful car, kernel.org administrator Konstantin Ryabitsev said at the beginning of his Korea Linux Forum talk. It had roomy seats, lots of features, and a smooth ride; it was all about power and comfort. But if you got into an accident with this car, it would kill you; it was not designed around the idea that things might go wrong. Our computer systems in 2015 mirror the Bel Air of 1957; they are not designed around humans and the mistakes they make. Konstantin had a simple message for the audience: take a cue from the automotive industry and design and build systems that do not fail catastrophically when errors are made.In 1955, the Journal of the American Medical Association said that the interiors of contemporary cars were so poorly designed that it was amazing when anybody escaped an accident without serious injury. Ten years later, Ralph Nader's seminal Unsafe at Any Speed was published. In response, automotive engineers said that they designed their cars to operate safely — they were designed to drive, not to crash. Crashes were the result of bad driving, so the proper response was better driver education. The addition of safety features would come at a cost in style and comfort; it would also cost more. Customers, they said, did not want those safety features.
Fifty years later, though, cars are designed around crumple zones and crumple-resistant passenger areas. They have airbags, seat belts with pre-tensioners, collision sensors, and more. Modern cars, Konstantin said, are designed with driver errors in mind; as a result, automotive fatalities are a fraction of their peak nearly 50 years ago.
Computers and their software, though, are still designed like 1960s cars. They are all about power and comfort. Engineers will say that these systems have been designed to run safely, that things fail when humans make mistakes. Protecting users from their own mistakes is expensive, safety features can hurt the usability of software, customers are not asking for more safety features, and so on. The problem is best solved, they say, with more user education.
Konstantin faced this problem full-on in 2011, when he was hired in the aftermath of the kernel.org compromise. The approach he found was to design security infrastructure like a medieval fortress — or like Helm's Deep from the Lord of the Rings. There is a big wall with archers to defend it, a second line of defense (consisting solely of Gimli the dwarf), an inner keep, and a final line made up of two old white guys. Plus a disaster-recovery plan called "Gandalf."
The thing is, we design systems like this, but then somebody gets in anyway. The forensics consultants are called in; they find out that the back door used was always there — the administrators used it to get their work done. Or the attacker used an internal PHP application that should have never been there; it has a comment saying "temporary for Bob," but nobody even remembers who Bob is. People make mistakes, and they always will; we need, he said, to think more about how we can prevent these mistakes from becoming security problems. We need, in other words, to equip our systems with airbags to prevent serious problems when things do go wrong.
Airbags for systems
Konstantin then went through the various levels of a system to talk about what those airbags might look like.
At the networking level, we are already deploying firewalls, using virtual LANs, zoning, and virtual private networks, and performing routine nmap scans. But there are a number of things we are not doing, starting with payload inspection to see what is happening on our network; that is hard, especially when encrypted traffic is involved. There are mechanisms for tracking the reputation of IP addresses for spam blocking, but reputations are not used for other kinds of traffic. We are not, in general, actually bothering with DNSSEC or bothering to check TLS certificates. Or even to use TLS certificates in many cases.
For servers, we are using virtualization for isolation, applying security updates, doing centralized logging, and using SSH keys for logging in. But we should be able to do far better than that. We should stop disabling SELinux (or AppArmor or whatever); they are there for when something goes wrong. SELinux can keep an eye on that PHP application that has no business connecting to other sites, digging through /proc, looking at /etc/passwd, scanning the network, or sending email. Running a system with SELinux enabled can be learned, Konstantin said; we need to stop turning it off.
We should also be using two-factor authentication on all of our servers. Hardware tokens (he favors YubiKeys) are better than software tokens running on phones, but either is better than nothing at all. SSH keys should be stored on smart cards (or a YubiKey NEO) rather than on laptops. The Linux Foundation team has put up a set of documents on how to make this combination work well with Linux.
Containers, he said, will not, contrary to some claims, make system
administrators obsolete. But they can help isolate software stacks from
each other. Think of a container, he said, as a sort of whole-OS static
![[Konstantin Ryabitsev]](https://static.lwn.net/images/conf/2015/klf-ks/KonstantinRyabitsev-sm.jpg "Konstantin Ryabitsev")
linking mechanism. They are a type of airbag: they allow a complex
software stack to be bundled away and hidden from the world; the whole
thing can then be further confined with SELinux. Containers also make good
crash-test dummies — they can be used to test software in production-like
environments. In such a setting, it's easy to check for open ports,
improper log files, etc. This, he said, "is what DevOps is about."
On workstations things are a bit more difficult; confining applications is not an easy task. SELinux is nearly useless on a desktop. The X Window System is the essence of pre-safety design; there is only security between users, and applications have full access to everything. So a single vulnerable X application means the compromise of the entire desktop. X, Konstantin said, must die. Unfortunately, that won't happen for a long time.
Then there is the issue of web browsers. They run code from untrusted outside users, they have a huge attack surface, and they have proprietary plugins. And we can't live without them. So we end up with issues like CVE-2015-4495, which was actively exploited to search systems for SSH keys and passwords.
As a rule, the most unprotected system on the entire net is the system administrator's desktop. It sits on the VPN with full access to the net, it has access to the password vault and is full of privileged SSH keys. There is also often a handy list of other systems that those keys will grant access to. The system is full of dangerous keystrokes, disclosing passwords to any attacker that happens by.
How does one address this threat? Requiring the use of one-time passwords — preferably not supplied by a phone app — is the first basic step. SSH keys should be stored on smart cards, and never in home directories. Proper security policies need to be written and administrators educated, forcefully if need be, to follow them. Konstantin also suggested looking into Qubes, which, he said, is the only serious attempt at workstation security out there. Qubes sidesteps most X vulnerabilities and can minimize the impact of things going wrong. Its safety orientation makes it "the Volvo of distributions."
When it comes to the functioning of administrative teams, there is no alternative to relying on education, so it is necessary to be prepared for failures. A team should establish secure communications so that its members can talk to each other when the network cannot be trusted. Email communications should employ PGP signatures, and instant messaging should be via a trusted mechanism as well. There need to be firm policies about what can be sent in clear text; important stuff should always be encrypted. Sites need workstation security policies, hardening checklists, and examples of secure workflows. Separate, dedicated browsers should be used for work and play. The system administrative team should use code review like any other development project, and changes should require signoffs.
Checklists should be created and used for everything: deployment of a new system, code review, staff onboarding, staff departure, etc. There should be a procedure to quickly lock out an administrator — a tricky task. Checklists can be the most powerful tool available to avoid bad experiences.
In closing, Konstantin reiterated that mistakes are going to happen; the important thing is to make sure that these accidents are not fatal. Our current systems are great to drive, but they do not forgive mistakes; we are at our "unsafe at any speed" moment. We have the technology to make things safer, but we're not using it; that needs to change. Konstantin and his team are putting together a set of recommended policies and are looking for help to improve them.
[Your editor would like to thank the Linux Foundation for supporting his travel to KLF].
Brief items
Security quote of the week
New vulnerabilities
abrt: data leak
| Package(s): | abrt | CVE #(s): | CVE-2015-5302 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 29, 2015 | Updated: | December 3, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bug report: A bug was found in libreport which causes that user's changes made to reported data are thrown away. Only the changes to the first file in the list are saved and the rest is discarded. It means that Bugzilla attachments can contain data that user wanted to remove. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
bouncycastle: invalid curve attack
| Package(s): | bouncycastle | CVE #(s): | CVE-2015-7940 | ||||||||||||||||||||
| Created: | November 4, 2015 | Updated: | January 5, 2016 | ||||||||||||||||||||
| Description: | From the openSUSE bug report:
bouncycastle versions older than 1.51 are vulnerable to an invalid curve attack as described in this article: http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html The attack allows to extract private keys used in elliptic curve cryptography with a few thousands queries. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
busybox: denial of service
| Package(s): | busybox | CVE #(s): | |||||
| Created: | November 2, 2015 | Updated: | November 4, 2015 | ||||
| Description: | From the Debian LTS advisory:
busybox, a collection of tiny utilities for small and embedded systems, was vulnerable to crashing when handling a specially crafted zip file. The issue was discovered by Gustavo Grieco. | ||||||
| Alerts: |
| ||||||
exfat-utils: two vulnerabilities
| Package(s): | exfat-utils | CVE #(s): | CVE-2015-8026 | ||||||||
| Created: | November 3, 2015 | Updated: | December 12, 2016 | ||||||||
| Description: | From the Mageia advisory:
Fix heap overflow and endless loop in exfatfsck exfat-utils is a collection of tools to work with the exFAT filesystem. Fuzzing the exfatfsck with american fuzzy lop led to the discovery of a write heap overflow and an endless loop. Especially at risk are systems that are configured to run filesystem checks automatically on external devices like USB flash drives. A malformed input can cause a write heap overflow in the function verify_vbr_checksum. It might be possible to use this for code execution. Another malformed input can cause an endless loop, leading to a possible denial of service. | ||||||||||
| Alerts: |
| ||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2015-7872 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 30, 2015 | Updated: | January 11, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the openSUSE vulnerability: A vulnerability in keyrings garbage collector allowed a local user to trigger an oops was found, caused by using request_key() or keyctl request2. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
krb5: multiple vulnerabilities
| Package(s): | krb5 | CVE #(s): | CVE-2015-2695 CVE-2015-2696 CVE-2015-2697 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 4, 2015 | Updated: | November 21, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory
- CVE-2015-2695: Applications which call gss_inquire_context() on a partially-established SPNEGO context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process crash. (bsc#952188). - CVE-2015-2696: Applications which call gss_inquire_context() on a partially-established IAKERB context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process crash. (bsc#952189). - CVE-2015-2697: Incorrect string handling in build_principal_va can lead to DOS (bsc#952190). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
libhtml-scrubber-perl: cross-site scripting
| Package(s): | libhtml-scrubber-perl | CVE #(s): | CVE-2015-5667 | ||||||||||||||||||||
| Created: | November 3, 2015 | Updated: | December 29, 2015 | ||||||||||||||||||||
| Description: | From the CVE entry:
Cross-site scripting (XSS) vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
libpng12: information leak
| Package(s): | libpng12 | CVE #(s): | CVE-2015-7981 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 2, 2015 | Updated: | November 17, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
An out-of-bounds read in png_convert_to_rfc1123() in png.c in libpng 1.2.x before 1.2.54 could potentially be exploited by a crafted PNG file to leak information from an application's memory. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libreswan: denial of service
| Package(s): | libreswan | CVE #(s): | CVE-2015-3240 | ||||||||||||||||||||
| Created: | November 4, 2015 | Updated: | November 5, 2015 | ||||||||||||||||||||
| Description: | From the Red Hat advisory:
A flaw was discovered in the way Libreswan's IKE daemon processed IKE KE payloads. A remote attacker could send specially crafted IKE payload with a KE payload of g^x=0 that, when processed, would lead to a denial of service (daemon crash). | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
lldpd: denial of service
| Package(s): | lldpd | CVE #(s): | CVE-2015-8011 CVE-2015-8012 | ||||
| Created: | October 30, 2015 | Updated: | November 4, 2015 | ||||
| Description: | From the Arch Linux advisory (note: The original Arch advisory text incorrectly labels these vulnerabilities as CVE-2015-5714 and CVE-2015-5715, both of which are Wordpress vulnerabilities addressed in an advisory published on the same day): CVE-2015-8011 (denial of service) - A buffer overflow has been discovered when handling management address TLV. When a remote device was advertising a too large management address while still respecting TLV boundaries, lldpd would crash due to a buffer overflow. CVE-2015-8012 (denial of service) - A vulnerability has been discovered that is triggering an application crash while using assert() if a malformed packet is handled. | ||||||
| Alerts: |
| ||||||
mediawiki: multiple vulnerabilities
| Package(s): | mediawiki | CVE #(s): | CVE-2015-8001 CVE-2015-8002 CVE-2015-8003 CVE-2015-8004 CVE-2015-8005 | ||||||||||||||||
| Created: | November 3, 2015 | Updated: | November 4, 2015 | ||||||||||||||||
| Description: | From the Mageia advisory:
In MediaWiki before 1.23.11, the API failed to correctly stop adding new chunks to the upload when the reported size was exceeded, allowing a malicious user to upload add an infinite number of chunks for a single file upload (CVE-2015-8001). In MediaWiki before 1.23.11, a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem (CVE-2015-8002). In MediaWiki before 1.23.11, it is not possible to throttle file uploads, or in other words, rate limit them (CVE-2015-8003). In MediaWiki before 1.23.11, a missing authorization check when removing suppression from a revision allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions (CVE-2015-8004). In MediaWiki before 1.23.11, thumbnails of PNG files generated with ImageMagick contained the local file path in the image (CVE-2015-8005). | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
mksh: improper sanitation
| Package(s): | mksh | CVE #(s): | |||||
| Created: | November 3, 2015 | Updated: | November 4, 2015 | ||||
| Description: | From the Gentoo advisory:
Improper sanitation of environment import allows for appending of values to passed parameters. An attacker who already had access to the environment could so append values to parameters passed through programs (including sudo(8) or setuid) to shell scripts, including indirectly, after those programs intended to sanitise the environment, e.g. invalidating the last $PATH component. | ||||||
| Alerts: |
| ||||||
mod_nss: incorrect multi-keyword mode cipherstring parsing
| Package(s): | mod_nss | CVE #(s): | CVE-2015-3277 | ||||
| Created: | November 2, 2015 | Updated: | November 4, 2015 | ||||
| Description: | From the Red Hat bugzilla:
It was reported that mod_nss is vulnerable to the issue similar to CVE-2015-3276, where incorrect parsing of multi-keyword cipherstring can lead to an unexpected ciphers list advertising. | ||||||
| Alerts: |
| ||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox thunderbird seamonkey nss | CVE #(s): | CVE-2015-4513 CVE-2015-7188 CVE-2015-7189 CVE-2015-7193 CVE-2015-7194 CVE-2015-7196 CVE-2015-7197 CVE-2015-7198 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 4, 2015 | Updated: | December 3, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-4513, CVE-2015-7189, CVE-2015-7194, CVE-2015-7196, CVE-2015-7198, CVE-2015-7197) A same-origin policy bypass flaw was found in the way Firefox handled certain cross-origin resource sharing (CORS) requests. A web page containing malicious content could cause Firefox to disclose sensitive information. (CVE-2015-7193) A same-origin policy bypass flaw was found in the way Firefox handled URLs containing IP addresses with white-space characters. This could lead to cross-site scripting attacks. (CVE-2015-7188) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox thunderbird seamonkey | CVE #(s): | CVE-2015-4514 CVE-2015-4515 CVE-2015-4518 CVE-2015-7187 CVE-2015-7195 CVE-2015-7199 CVE-2015-7200 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 4, 2015 | Updated: | December 3, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2015-4514 (Miscellaneous memory safety hazards): Christian Holler, Andrew McCreight, Georg Fritzsche, Tyson Smith, and Carsten Book reported crash and memory safety problems that affect Firefox 41. - CVE-2015-4515 (Information disclosure through NTLM authentication): Security researcher Tim Brown reported that Firefox discloses the hostname and possibly the Windows domain through NTLM-based HTTP authentication when sending type 3 messages as part of the authentication exchange. This is because the Workstation field is populated with the hostname of the system making the request. An attacker can craft a malicious page to send a silent NTLM request that will disclose the information without visibility in the client, leading to information disclosure. This is mitigated because NTLM v1 is disabled by default configurations. - CVE-2015-4518 (CSP bypass due to permissive Reader mode whitelist): Security researcher Mario Heiderich reported an issue where the security protections of Reader mode in Firefox can be bypassed, allowing scripts to be run. Mozilla developer Frederik Braun independently discovered and reported this same issue as well. This issue happens even though Reader View explicitly disables script for rendered pages through a whitelist of allowed HTML content. Mario discovered that the whitelist was too permissive and a malicious site could manipulate content to bypass CSP protections, allowing for possible cross-site scripting (XSS) attacks. - CVE-2015-7187 (Disabling scripts in Add-on SDK panels has no effect): Add-on authors Jason Hamilton and Peter Arremann with AMO editor Sylvain Giroux reported a vulnerability when a panel is created using the Add-on SDK in a browser extension. Defining a panel with script: false is supposed to disable script execution but it was found that inline script would still execute. This flaw allows for the potential execution of script content in an extension when it was been explicitly disallowed. The potential impact of this flaw would depend on whether the add-on was relying on script: false as a security mechanism and from location the panel content was loaded. No add-ons served from addons.mozilla.org are vulnerable to this flaw but add-ons installed from third party sites may be. - CVE-2015-7195 (Certain escaped characters in host of Location-header are being treated as non-escaped): Security researcher Frans Rosén reported that URLs with certain escaped characters in hostnames are parsed incorrectly. This leads to parsing being abandoned when an effected escaped character is encountered followed by a navigation to the previously parsed version of the URL. When combined with a site allowing for navigation redirection that allows for escaped characters, this could lead to potential extraction of site specific tokens. - CVE-2015-7198, CVE-2015-7199 CVE-2015-7200 (Vulnerabilities found through code inspection): Security researcher Ronald Crane reported three vulnerabilities affecting released code that were found through code inspection. These included a buffer overflow in the ANGLE graphics library and two issues of missing status checks in SVG rendering and during cryptographic key manipulation. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
nss, nspr: code execution
| Package(s): | nss, nspr | CVE #(s): | CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 4, 2015 | Updated: | December 2, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A use-after-poison flaw and a heap-based buffer overflow flaw were found in the way NSS parsed certain ASN.1 structures. An attacker could use these flaws to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library. (CVE-2015-7181, CVE-2015-7182) A heap-based buffer overflow was found in NSPR. An attacker could use this flaw to cause NSPR to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSPR library. (CVE-2015-7183) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
ntp: information leak
| Package(s): | ntp | CVE #(s): | CVE-2014-9750 | ||||||||||||||||||||||||||||
| Created: | November 4, 2015 | Updated: | November 4, 2015 | ||||||||||||||||||||||||||||
| Description: | From the CVE entry: ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
openafs: plaintext leak
| Package(s): | openafs | CVE #(s): | CVE-2015-7762 CVE-2015-7763 | ||||||||||||||||
| Created: | October 30, 2015 | Updated: | November 4, 2015 | ||||||||||||||||
| Description: | From the OpenAFS advisory: When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx implementations do not initialize three octets of data that are padding in the C language structure and were inadvertently included in the wire protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75 through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.33 include a variable-length padding at the end of the ACK packet, in an attempt to detect the path MTU, but only four octets of the additional padding are initialized (CVE-2015-7763). Rx implementations derived from Project Andrew use a pool of packet structures, so that the uninitialized data sent on the wire in an ACK packet is the plaintext of some previous packet, including packets that were received encrypted and then decrypted in-place. (All packet decryption is performed in-place.) Furthermore, when the packet being acknowledged is a duplicate or outside the valid window of sequence numbers, the decrypted packet is immediately used to construct the return ACK packet, giving an attacker control over what plaintext will be leaked. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
phpmyadmin: content spoofing
| Package(s): | phpmyadmin | CVE #(s): | CVE-2015-7873 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 29, 2015 | Updated: | November 11, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory: Content spoofing vulnerability when redirecting user to an external site. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
roundcubemail: two vulnerabilities
| Package(s): | roundcubemail | CVE #(s): | CVE-2015-8105 | ||||||||||||
| Created: | November 4, 2015 | Updated: | March 9, 2016 | ||||||||||||
| Description: | From the openSUSE advisory:
roundcubemail was updated to version 1.0.7 to fix two security issues.
These security issues were fixed: The package comes with a fixed configuration. If you modified the file "/etc/apache2/conf.d/roundcubemail.conf", please replace it with the configuration "roundcubemail.conf.rpmnew" and reapply your changes. After that, a restart of apache2 is required. Update: The XSS issue was assigned CVE-2015-8105. From the CVE entry: Cross-site scripting (XSS) vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload. | ||||||||||||||
| Alerts: |
| ||||||||||||||
springframework: Reflected File Download (RFD) attack
| Package(s): | springframework | CVE #(s): | CVE-2015-5211 | ||||||||||||
| Created: | November 2, 2015 | Updated: | November 5, 2015 | ||||||||||||
| Description: | From the Red Hat bugzilla:
Under some situations, the Spring Framework is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response. | ||||||||||||||
| Alerts: |
| ||||||||||||||
util-linux: denial of service
| Package(s): | util-linux | CVE #(s): | CVE-2015-5218 | ||||||||
| Created: | November 4, 2015 | Updated: | November 4, 2015 | ||||||||
| Description: | From the openSUSE bug report:
Buffer overflow / crash in colcrt with unclear effect. "When running colcrt with a big input it crashes because of a global-buffer-overflow caused by a global variable 'page' defined in 'text-utils/colcrt.c:73:9" | ||||||||||
| Alerts: |
| ||||||||||
wireshark: denial of service
| Package(s): | wireshark | CVE #(s): | CVE-2015-3906 | ||||
| Created: | November 2, 2015 | Updated: | November 4, 2015 | ||||
| Description: | From the CVE entry:
The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815. | ||||||
| Alerts: |
| ||||||
wordpress: cross-site scripting
| Package(s): | wordpress | CVE #(s): | CVE-2015-7989 | ||||||||
| Created: | October 30, 2015 | Updated: | November 4, 2015 | ||||||||
| Description: | From the Arch Linux advisory: A cross-site scripting vulnerability has been discovered in the user list tables. | ||||||||||
| Alerts: |
| ||||||||||
xen: multiple vulnerabilities
| Package(s): | xen | CVE #(s): | CVE-2015-7311 CVE-2015-7835 CVE-2015-7969 CVE-2015-7971 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 2, 2015 | Updated: | November 9, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image. (CVE-2015-7311) The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping. (CVE-2015-7835) Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall. (CVE-2015-7969) Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c. (CVE-2015-7971) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
xscreensaver: denial of service
| Package(s): | xscreensaver | CVE #(s): | CVE-2015-8025 | ||||||||||||||||||||||||||||
| Created: | November 2, 2015 | Updated: | January 11, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
xscreensaver, a screensaver daemon and frontend for X11 was vulnerable to crashing when hot-swapping monitors. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>