Security
The perils of federated protocols
The lure of "federation" for internet services is potent, since it allows disparate providers to interoperate and users to choose the provider that (most) meets their needs—or to become their own provider. Many of the longtime services, such as email, web serving, DNS, and others, are federated, but many of the newest services decidedly are not. That tension is playing out right now for the Signal open-source encrypted messaging and voice application from Open Whisper Systems (OWS) and others who would like to be able to federate with it.
Signal and LibreSignal
The Signal app for Android is available under the GPLv3, but it is not fully free in the eyes of some because it relies on the Google Cloud Messaging (GCM) service that is part of Google Play Services. That means that some amount of metadata (but not the contents of the encrypted messages) traverses Google's servers. For privacy reasons, some have changed the Signal app to eliminate that dependency, which is something that its license clearly allows, but they still want those changed apps to be able to communicate with the rest of the Signal-using world. That's where the problem starts.
A service like Signal relies upon servers as intermediaries—and servers are not free. If apps like LibreSignal—a fork of the Signal app that removes the GCM dependency—want to communicate with other Signal users, they must either use the same servers or run their own servers that are federated with those run by OWS. But that is not to be.
In a thread on the LibreSignal issue tracker, OWS developer Moxie Marlinspike stated that OWS did not want LibreSignal to use its servers (nor to use "Signal" as part of its name):
If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product.
One of the LibreSignal developers, Michel Le Bihan (posting as mimi89999),
said that the project was willing to change the name, but wondered:
"If I finance running a TextSecure server for LibreSignal, will you
federate with us?
" Marlinspike deemed
that improbable: "It is unlikely that we will ever federate with any servers outside of our control again, it makes changes really difficult.
"
A few years back, the encrypted-messaging piece of Signal, TextSecure, was federated with the CyanogenMod servers so that users of that platform could send messages to TextSecure users on other platforms. That federation is no longer happening; Marlinspike explained the problems that federating caused:
Marlinspike expanded his thoughts on federated protocols in a blog post. The crux of the problem with federated protocols is that the entire ecosystem is moving too fast for services to support them. It restricts what the service provider can change because the existing features still need to be supported:
I thought about it. We got to the first production version of IP, and have been trying for the past 20 years to switch to a second production version of IP with limited success. We got to HTTP version 1.1 in 1997, and have been stuck there until now. Likewise, SMTP, IRC, DNS, XMPP, are all similarly frozen in time circa the late 1990s. To answer his question, that's how far the internet got. It got to the late 90s.
That has taken us pretty far, but it's undeniable that once you federate your protocol, it becomes very difficult to make changes. And right now, at the application level, things that stand still don't fare very well in a world where the ecosystem is moving.
Indeed, cannibalizing a federated application-layer protocol into a centralized service is almost a sure recipe for a successful consumer product today. It's what Slack did with IRC, what Facebook did with email, and what WhatsApp has done with XMPP. In each case, the federated service is stuck in time, while the centralized service is able to iterate into the modern world and beyond.
So while it's nice that I'm able to host my own email, that's also the reason why my email isn't end to end encrypted, and probably never will be. By contrast, WhatsApp was able to introduce end to end encryption to over a billion users with a single software update.
But he also recognized some of the downsides to his conclusions.
Federation allows users to choose who has access to their metadata, but it
generally already a lost cause because there are typically just a few
providers—or even a single provider (e.g. Gmail)—that provide most users
with the service. Though he believes it is impossible to have a new federated
service on today's internet, he is not entirely happy with that outcome:
"it's something that I'd love to be proven wrong about
".
XMPP?
Various posters in the issue-tracker thread pointed to Extensible Messaging and Presence Protocol
(XMPP) as a potential solution, along with various projects (such as Conversations and ChatSecure) that use XMPP. Marlinspike
is not
particularly hopeful that XMPP-based solutions will lead to a
successful messaging network, as Signal's non-federated approach has done.
He noted that the Guardian
project has been working on the problem as long as OWS has, "so
why are Signal's growth, ratings, and engagement substantially
higher?
"
In his blog post, he gets more specific about the shortcomings of XMPP that he sees. While it is an extensible protocol, that extensibility leads to problems of its own:
One of the most user-friendly choices that Signal made was to use the phone
numbers already stored in the contacts list as the identifiers for sending
messages—exactly like regular SMS text messages. It is "not possible
to build an identity this simple in a federated landscape
",
Marlinspike said.
The focus for Signal is on making it usable for ordinary users:
We want to produce technology that is privacy preserving but feels just like everything else people already use, not somehow convince everyone to fundamentally change their workflow and their expectations.
But the fact remains that Signal uses Google services and various people (including some that are precisely the target audience for encrypted messaging) do not trust Google or, perhaps, worry about what the company might be compelled to do by various governments. Those who want to communicate with other Signal users but not with Google servers are shut out. In a post on his blog, Matthew Garrett laments the situation:
Right now the choices I have for communicating with people I know are either convenient and secure but require non-free code (Signal), convenient and free but insecure (SMS) or secure and free but horribly inconvenient (gpg). Is there really no way for us to work as a community to develop something that's all three?
Comments on that post point to various options that may more or less fill those needs, but the lack of a network effect for projects that were listed, such as Matrix, make them a hard sell in the "convenience" department. But "walled gardens" are just that—federation is one way out of that particular trap. For companies that are trying to build their business, though, walled gardens have some obvious appeal, which may also be playing into the plans of OWS.
Centralization
Part of the reason that Marlinspike's thoughts are striking a chord in some circles (this Hacker News thread for example) is because of his reputation in fields like cryptography and security, as well as for having been instrumental in building the popular Signal service and apps. Much of the internet is built on federated technology, which has led to a lot of innovation and important progress along the way. It is concerning to many (perhaps including Marlinspike) that centralized services may be the way forward.
It is a difficult problem. Free, secure, and convenient solutions in the messaging space have not (yet?) come about. Even non-realtime encrypted communication via email is inconvenient, at best, and effectively unusable by those who are not tech savvy. Trusting some centralized service to handle all that may provide convenience, but there are always going to be concerns about the trustworthiness of that provider (and the code it runs). This is not really a new problem for the free-software world, but Marlinspike's thoughts have brought it into sharp focus. Difficult or no, it is a problem worth solving.
Brief items
Security quotes of the week
This chilling effect, pulled out of a survey of 41,000 U.S. households who use the Internet, show the insecurity of the Web is beginning to have consequences that stretch beyond the direct fall-out of an individual losing personal data in breach. The research suggests some consumers are reaching a tipping point where they feel they can no longer trust using the Internet for everyday activities.
Yubico: Secure hardware vs. open source
Yubico has posted a blog entry defending the company's decision to switch to closed-source code in the Yubikey 4 product. "If you have to pick only one, is it more important to have the source code available for review or to have a product that includes serious countermeasures for attacks against the integrity of your keys?"
See also: Konstantin
Ryabitsev's response to this posting. "When it comes to any
hardware, we must at some point trust the manufacturer -- unless we have
very large budgets that would allow us to fully monitor every step of the
manufacturing process. In the absence of such large budgets, we must base
our trust on the company's prior record and their willingness to work with
the community to show that their hands are clean and their intentions are
pure. Putting out a blackbox proprietary device after all the good will you
have built up with NEOs sends the exact opposite message.
"
Announcing Certbot: EFF's Client for Let's Encrypt
The Electronic Frontier Foundation (EFF) has announced a new name and web site for the Let's Encrypt client. The Let's Encrypt project is a free certificate authority for TLS certificates that enable HTTPS for the web. The client, now called "Certbot", uses Automatic Certificate Management Environment (ACME) to talk to the Let's Encrypt CA, though it will no longer be the "official" client and there are other ACME clients that can be used. "Along with the rename, we've also launched a brand new website for Certbot, found at https://certbot.eff.org. The site includes frequently asked questions as well as links to how you can learn more and help support the project, but by far the biggest feature of the website is an interactive instruction tool. To get the specific commands you need to get Certbot up and running, just input your operating system and webserver. No more searching through pages and pages of documentation or Google search results! While a new name has the potential for creating technical issues, the Certbot team has worked hard to make this transition as seamless as possible. Packages installed from PyPI, letsencrypt-auto, and third party plugins should all continue to work and receive updates without modification. We expect OS packages to begin using the Certbot name in the next few weeks as well. On many systems, the current client packages will automatically transition to Certbot while continuing to support the letsencrypt command so you won't have to edit any scripts you're currently using."
Major remote SSH security issue in CoreOS Linux Alpha
Should you happen to be running a CoreOS alpha release in an exposed setting, you'll want to have a look at this advisory and do a quick upgrade. "A misconfiguration in the PAM subsystem in CoreOS Linux Alpha 1045.0.0 and 1047.0.0 allowed unauthorized users to gain access to accounts without a password or any other authentication token being required. This vulnerability affects a subset of machines running CoreOS Linux Alpha. Machines running CoreOS Linux Beta or Stable releases are unaffected."
New vulnerabilities
atheme: two vulnerabilities
| Package(s): | atheme | CVE #(s): | CVE-2014-9773 CVE-2016-4478 | ||||||||
| Created: | May 17, 2016 | Updated: | May 24, 2016 | ||||||||
| Description: | From the openSUSE advisory:
- CVE-2016-4478: Under certain circumstances, a remote attacker could cause denial of service due to a buffer overflow in the XMLRPC response encoding code. - CVE-2014-9773: Remote attacker could change Atheme's behavior by registering/dropping certain accounts/nicks. | ||||||||||
| Alerts: |
| ||||||||||
cacti: SQL injection
| Package(s): | cacti | CVE #(s): | CVE-2016-3172 | ||||||||||||||||
| Created: | May 18, 2016 | Updated: | May 18, 2016 | ||||||||||||||||
| Description: | From the CVE entry:
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
chromium: multiple vulnerabilities
| Package(s): | chromium nodejs v8 | CVE #(s): | CVE-2016-1667 CVE-2016-1668 CVE-2016-1669 CVE-2016-1670 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2016 | Updated: | September 22, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory: CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski. CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski. CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han. CVE-2016-1670: Race condition in loader. Credit to anonymous. Note that these vulnerabilities affect the V8 engine used in other packages as well. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
chromium: directory traversal
| Package(s): | chromium | CVE #(s): | CVE-2016-1671 | ||||
| Created: | May 17, 2016 | Updated: | May 18, 2016 | ||||
| Description: | From the CVE entry:
Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/escape.cc and net/base/filename_util.cc. | ||||||
| Alerts: |
| ||||||
docker: privilege escalation
| Package(s): | docker | CVE #(s): | CVE-2016-3697 | ||||||||||||||||||||||||||||||||
| Created: | May 13, 2016 | Updated: | December 12, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory: It was found that Docker would launch containers under the specified UID instead of a username. An attacker able to launch a container could use this flaw to escalate their privileges to root within the launched container. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
dosfstools: two vulnerabilities
| Package(s): | dosfstools | CVE #(s): | CVE-2015-8872 CVE-2016-4804 | ||||||||||||||||||||||||||||
| Created: | May 16, 2016 | Updated: | September 6, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
It was discovered that there was an invalid memory and heap overflow vulnerability in dosfstools, a collection of utilities for making and checking MS-DOS FAT filesystems. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
expat: code execution
| Package(s): | expat | CVE #(s): | CVE-2016-0718 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 18, 2016 | Updated: | December 15, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
glibc: denial of service
| Package(s): | glibc | CVE #(s): | CVE-2016-3706 | ||||||||||||||||||||||||||||
| Created: | May 13, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Red Hat bug report: stack (frame) overflow in getaddrinfo() when called with AF_INET, AF_INET6 (incomplete fix for CVE-2013-4458). | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
ioprocess: invalid md5sum
| Package(s): | ioprocess | CVE #(s): | |||||||||
| Created: | May 17, 2016 | Updated: | May 18, 2016 | ||||||||
| Description: | From the Red Hat bugzilla:
http://pkgs.fedoraproject.org/cgit/ioprocess.git/commit/ introduced a new upstream tarball with different md5sum stating fixes in changelog. The spec file doesn't explain how the tarball has been generated. Being 0.15.0 released lot of time ago (https://github.com/oVirt/ioprocess/releases/tag/v0.15.0) , md5sum shouldn't be changed. Marking this as security violation. | ||||||||||
| Alerts: |
| ||||||||||
jackson-dataformat-xml: XXE attack
| Package(s): | jackson-dataformat-xml | CVE #(s): | CVE-2016-3720 | ||||||||||||
| Created: | May 16, 2016 | Updated: | May 18, 2016 | ||||||||||||
| Description: | From the Red Hat bugzilla:
It was reported that XmlMapper in jackson-dataformat-xml is vulnerable to XXE attack ("Improper Restriction of XML External Entity Reference"). | ||||||||||||||
| Alerts: |
| ||||||||||||||
jansson: denial of service
| Package(s): | jansson | CVE #(s): | CVE-2016-4425 | ||||||||||||||||||||||||||||
| Created: | May 16, 2016 | Updated: | September 28, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Gustavo Grieco discovered that jansson, a C library for encoding, decoding and manipulating JSON data, did not limit the recursion depth when parsing JSON arrays and objects. This could allow remote attackers to cause a denial of service (crash) via stack exhaustion, using crafted JSON data. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
kernel: information disclosure
| Package(s): | kernel | CVE #(s): | CVE-2016-4482 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
A vulnerability was found in Linux kernel. There is an information leak In the USB module (drivers/usb/core/devio.c). The stack object "ci" has a total size of 8 bytes. Its last 3 bytes are padding bytes which are not initialized and leaked to userland | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: privilege escalation
| Package(s): | kernel | CVE #(s): | CVE-2016-0758 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A flaw was found in the way the Linux kernel's ASN.1 DER decoder processed certain certificate files with tags of indefinite length. A local, unprivileged user could use a specially crafted X.509 certificate DER file to crash the system or, potentially, escalate their privileges on the system. (CVE-2016-0758, Important) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: privilege escalation
| Package(s): | kernel | CVE #(s): | CVE-2016-3713 | ||||||||||||||||||||||||||||||||||||
| Created: | May 17, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of service (system crash) in the host, expose sensitive information from the host, or possibly gain administrative privileges in the host. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-4581 CVE-2016-4485 CVE-2016-4486 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 16, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-4581: It was reported that when first propagated copy is a slave, it causes kernel oops. This oops happens with the namespace_sem held and can be triggered by non-root users. CVE-2016-4485: An information leak vulnerability in llc module was found in net/llc/af_llc.c. The stack object “info” has a total size of 12 bytes. Its last byte is padding which is not initialized and leaked via “put_cmsg”. CVE-2016-4486: An information leak vulnerability in rtnetlink was found in net/core/rtnetlink.c. The stack object “map” has a total size of 32 bytes. Its last 4 bytes are padding generated by compiler. These padding bytes are not initialized and sent out via “nla_put”. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libksba: denial of service
| Package(s): | libksba | CVE #(s): | CVE-2016-4574 | ||||||||||||||||||||||||||||
| Created: | May 13, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory: An out-of-bound read access due to incorrect utf-8 strings handling has been in found in the _ksba_dn_to_str() function. This issue is due to an incomplete fix for CVE-2016-4356, caused by an off-by-one error when handling incorrect utf-8 strings. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
libksba: denial of service
| Package(s): | libksba | CVE #(s): | CVE-2016-4579 | ||||||||||||||||||||
| Created: | May 17, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A vulnerability was found in libksba. The returned length of the object from _ksba_ber_parse_tl (ti.length) was not always checked against the actual buffer length, thus leading to a read access after the end of the buffer and a crash. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
libksba: multiple vulnerabilities
| Package(s): | libksba | CVE #(s): | CVE-2016-4353 CVE-2016-4354 CVE-2016-4355 CVE-2016-4356 | ||||||||||||
| Created: | May 18, 2016 | Updated: | May 18, 2016 | ||||||||||||
| Description: | From the Ubuntu advisory:
Hanno Böck discovered that Libksba incorrectly handled decoding certain BER data. An attacker could use this issue to cause Libksba to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-4353) Hanno Böck discovered that Libksba incorrectly handled decoding certain BER data. An attacker could use this issue to cause Libksba to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-4354, CVE-2016-4355) Hanno Böck discovered that Libksba incorrectly handled incorrect utf-8 strings when decoding certain DN data. An attacker could use this issue to cause Libksba to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-4356) | ||||||||||||||
| Alerts: |
| ||||||||||||||
libndp: man-in-the-middle attacks
| Package(s): | libndp | CVE #(s): | CVE-2016-3698 | ||||||||||||||||||||||||||||||||||||||||
| Created: | May 17, 2016 | Updated: | May 25, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol (NDP) messages. An attacker on a non-local network could use this flaw to advertise a node as a router, allowing them to perform man-in-the-middle attacks on a connecting client, or disrupt the network connectivity of that client. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
librsvg: denial of service
| Package(s): | librsvg | CVE #(s): | CVE-2016-4347 CVE-2016-4348 | ||||||||||||
| Created: | May 18, 2016 | Updated: | May 18, 2016 | ||||||||||||
| Description: | From the Debian LTS advisory:
DoS in librsvg 2.40.2 parsing SVGs with circular definitions were found (they will produce stack exhaustion) by Gustavo Grieco. | ||||||||||||||
| Alerts: |
| ||||||||||||||
libxml2: denial of service
| Package(s): | libxml2 | CVE #(s): | CVE-2016-3627 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 13, 2016 | Updated: | May 20, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory: libxml2 limits the number of recursions an XML document can contain so to protect against the "Billion Laughs" denial-of-service attack. Unfortunately, the underlying counter was not incremented properly in all necessary locations. Therefore, specially crafted XML documents could exhaust all available stack space and crash the XML parser without running into the recursion limit. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
ocaml: information leak
| Package(s): | ocaml | CVE #(s): | CVE-2015-8869 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2016 | Updated: | February 21, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian-LTS advisory:
OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes sizes arguments to an internal memmove call to be sign-extended from 32 to 64-bits before being passed to the memmove function. This leads arguments between 2GiB and 4GiB to be interpreted as larger than they are (specifically, a bit below 2^64), causing a buffer overflow. Arguments between 4GiB and 6GiB are interpreted as 4GiB smaller than they should be, causing a possible information leak. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
openshift: multiple vulnerabilities
| Package(s): | openshift | CVE #(s): | CVE-2016-2149 CVE-2016-2160 CVE-2016-3711 | ||||
| Created: | May 13, 2016 | Updated: | May 18, 2016 | ||||
| Description: | From the Red Hat advisory: A flaw was found in the building of containers within OpenShift Enterprise. An attacker could submit an image for building that executes commands within the container as root, allowing them to potentially escalate privileges. (CVE-2016-2160) It was found that OpenShift Enterprise would disclose log file contents from reclaimed namespaces. An attacker could create a new namespace to access log files present in a previously deleted namespace using the same name. (CVE-2016-2149) An information disclosure flaw was discovered in haproxy as used by OpenShift Enterprise; a cookie with the name "OPENSHIFT_[namespace]_SERVERID" was set, which contained the internal IP address of a pod. (CVE-2016-3711) | ||||||
| Alerts: |
| ||||||
openvpn: multiple vulnerabilities
| Package(s): | openvpn | CVE #(s): | |||||||||||||
| Created: | May 16, 2016 | Updated: | May 23, 2016 | ||||||||||||
| Description: | Openvpn-2.3.11 fixes multiple issues with unspecified impact. See the openvpn changelog for details. | ||||||||||||||
| Alerts: |
| ||||||||||||||
qemu: information leak
| Package(s): | qemu, qemu-kvm | CVE #(s): | CVE-2016-4020 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2016 | Updated: | May 31, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Donghai Zdh discovered that QEMU incorrectly handled the Task Priority Register(TPR). A privileged attacker inside the guest could use this issue to possibly leak host memory bytes. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-4020) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
squid: cache poisoning
| Package(s): | squid | CVE #(s): | CVE-2016-4553 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2016 | Updated: | May 18, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
Due to incorrect data validation of intercepted HTTP Request messages Squid is vulnerable to clients bypassing the protection against CVE-2009-0801 related issues. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source (CVE-2016-4553). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
wpa: two vulnerabilities
| Package(s): | wpa | CVE #(s): | CVE-2016-4476 CVE-2016-4477 | ||||||||||||||||
| Created: | May 16, 2016 | Updated: | October 10, 2016 | ||||||||||||||||
| Description: | From the CVE entries:
hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation. (CVE-2016-4476) wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command. (CVE-2016-4477) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
xen: denial of service
| Package(s): | xen | CVE #(s): | CVE-2015-8615 | ||||
| Created: | May 18, 2016 | Updated: | May 18, 2016 | ||||
| Description: | From the CVE entry:
The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ). | ||||||
| Alerts: |
| ||||||
xerces-c: code execution
| Package(s): | xerces-c | CVE #(s): | CVE-2016-2099 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 12, 2016 | Updated: | July 6, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian-LTS advisory:
XMLReader class can raise an exception if an invalid character is encountered, and the exception crosses stack frames in an unsafe way that causes a higher level exception handler to access an already-freed object. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>