Security
Spam reduction with greylisting
Running your own email server involves trying to keep back the tide of unsolicited email often known as spam, and a good way to do this is to understand that most spam comes from botnets rather than real mail servers. Greylisting is a lightweight and elegant technique for distinguishing between the two sources of email and, when we look at the numbers, it turns out to be surprisingly effective.A common body of opinion says that there is no good reason to run your own mail server. Organizations such as Google will, for not much money, allow you to run your entire corporate email as a hosted service. You can use the mail client of your choice, thanks to services like IMAP and SMTP AUTH decoupling the client experience from the back-end provider; there's also an excellent webmail interface for when you're out and about. Nevertheless, my experience is that, sooner or later, some shortcoming proves to be an inconvenience to the business. Perhaps the webmail site is blocked by some client network you're visiting, or important list emails aren't reaching your inbox and you can't work out why. Maybe the hosting provider has made some arbitrary decisions about content and some of your new employees find their names are unacceptable and they cannot sign up. When this happens, and if your provider is unhelpful or unresponsive, you will find yourself revisiting the decision to run your own server.
Should you decide to run your own, however, you will lose all the beneficial content filtering that your provider was doing — specifically, slimming the torrent of unsolicited commercial email that bedevils us all. There are many content filters, some commercial but many free, which can be inserted into the delivery pipeline of most mail servers to examine each incoming mail. This, however, is the point where you discover that the internet can deliver rubbish to your server more quickly than you can easily and cheaply scan it, and the departmental budget is carefully examined to see if it can accommodate a couple of big compute servers to run the spam filtering.
The cheapest, easiest tests are those that are done during the early phases of the SMTP transaction, specifically the EHLO, MAIL FROM, and RCPT TO phases, before the DATA phase is entered and the body of the email is transmitted. Any rejection that can be done at this early stage is cheap, both in network terms (because the message has not yet been transmitted) and in compute terms (because processing the few tens of bytes the client has thus far sent generally requires less hardware than processing an 8MB MIME-encoded email). There are tests that can be done at the EHLO phase, such as those relating to the resolvability and validity of the client hostname, and at the MAIL FROM phase, such as checking the client IP address against any Sender-Policy-Framework records advertised for the sender's declared domain name. Other tests can be done here, such as realtime blackhole list (RBL) lookups; I do not use those, since I've found no RBL to be sufficiently reliable for use as a bright-line test for acceptance (rather than as contributors to a total spam score in the content-based filtering system that comes later in the pipeline).
But at this stage you have three pieces of information — the sender's IP address, and the envelope sender and recipient addresses — so another elegant test can now be applied. To understand this test, it is necessary to appreciate that much of the spam email on the internet does not come from expensively-hosted bulk email senders, though those do exist. Instead, perhaps as much as 85% comes from botnets — distributed networks of compromised computers, each under the control of a single malicious actor. Many such actors use their botnets to send large quantities of unsolicited commercial email, usually for pay on behalf of third-parties.
In a perfect world, SMTP would contain an exchange where the server asked Are you a real mail server?, and the client would reply "Yes, definitely", or "No, I'm part of a botnet". The client would tell the truth, and the server would accept mail only from clients that were themselves real mail servers. Sadly, we're not there yet. Until we are, one excellent way to distinguish botnet members from real mail servers is to ask the client to behave like a real mail server. One thing real mail servers are required to do is to cope with temporary disappointment, such as the receiving server not having enough free disk space or the user's mailbox being temporarily locked. When a receiving server says it has a temporary problem by means of a 400-class return code, the sender should wait for a while, then retry the transaction. Most botnet clients are senders of a type known as fire-and-forget; they just want to zip through the fifty-million recipient addresses they've been given. If the one they're on right now has a temporary problem, well, that's just too bad; they drop that email on the floor and go on to the next one.
Greylisting
Greylisting takes advantage of this difference in behavior. A receiving server can require a sending client to prove its bona fides by temporarily refusing an email on first delivery attempt while making a note of the triplet consisting of the sender's IP address, the envelope sender, and envelope recipient. When a client arrives with an email with a matching triplet, the server assumes that this is a redelivery attempt and accepts the email. A well-behaving greylist will then add the triplet to a whitelist; having proved itself once, should the same client try to send other mail from the same sender to the same recipient, there's no reason not to accept it straightaway, at least for a while. Some implementations will extend this courtesy to any mail from that client. To prevent botnet members from simply trying each delivery twice, back-to-back, most implementations will require a certain time to elapse between the first delivery attempt, and the redelivery attempt that is permitted to succeed.More subtlety is possible. In the simplest case, IP addresses under one's direct control can be configured as automatically whitelisted. Since few botnet mailers implement SMTP STARTTLS, any email that arrives under cover of SMTP encryption can be accepted immediately. Any mail that is submitted after SMTP AUTH succeeds is clearly from a legitimate local user, and can again be accepted immediately.
Greylisting is not without its downsides. The biggest problem is that much email will be delayed, and the size of this delay is not under the control of the receiver. Although most greylisting implementations will print a human-readable message indicating how long the sending server must wait before redelivery can succeed, there is as yet no standards-based way for the sender to recognize this, and wait only that long before retrying. Instead, the client will have its own configuration telling it how often to retry and, if this does not match the greylist's expectations, severely delayed deliveries can result. Although email delivery has never, in principle, been guaranteed nor instantaneous, some users have developed expectations outside the service guarantees. As Wikipedia dryly notes:
Problems arise with service providers that maintain a bank of sending servers, and move queued emails between these servers after each delivery attempt. Since the triplet includes the sender IP, this means each redelivery attempt is seen by greylisting as being a new email; much time can elapse before an email is lucky enough to be tried a second time from a given sending server. This is not, in my experience, common, but it does happen; all one can then do is add the whole bank of servers to an IP whitelist.
How effective is it?
My mail server is not a big one, and the community it serves is fairly small. Nonetheless, it's been on the internet a long time, and I see no reason to think it non-representative. I looked at the logs for incoming mail for September 2016, and this broke down as follows, approximately:- There were 101,900 inbound delivery attempts
- Of these 101,900, 3,370 were SPF failures, 1,300 were from invalid sender hostnames, and 3,800 were to invalid recipients, leaving 93,400
- Of those 93,400, 71,100 attempted no redelivery and so failed greylisting, leaving 22,300 which passed greylisting and went on to local delivery
- Of those 22,300, 7,800 were list emails filed via procmail, leaving 14,500 which went to the content-based spam filtering system
- Of those 14,500, 3,600 were identified as spam by content-based filtering
Wikipedia says that greylisting typically delays email by about 15 minutes. Looking at my body of emails from September 2016, where greylisting delayed delivery of an inbound email the median delay was 900 seconds. The mean, however, was around 8,000s, due to a long-tailed distribution (a comparatively small number of very large delays). Nonetheless, assuming that all the mail that didn't pass greylisting was spam, greylisting is the single most effective antispam technique on my mail server.
If you're of a mind to give greylisting a try on your mail server, Sendmail does it most easily through the milter interface. My Sendmail uses milter-greylist, which works well and painlessly for me; the project has instructions on configuring it with Sendmail. The milter-greylist developers also note that it works with Postfix, but those instructions seem to be a lot thinner, and other implementations like postgrey may work better. Ubuntu seems to recommend postgrey for Postfix, and the CentOS people also have a HOWTO for it. Exim has always been a bit of a mystery for me, but greylisting.org has a number of suggestions for greylisting with Exim. It would be nice if greylisting capabilities shipped as a standard part of all major mail transport agents (MTAs), but until then it should be fairly easy to glue it onto your MTA of choice.
Brief items
Security quotes of the week
New vulnerabilities
apache: denial of service
| Package(s): | apache httpd | CVE #(s): | CVE-2016-1546 | ||||
| Created: | October 7, 2016 | Updated: | October 12, 2016 | ||||
| Description: | From the CVE entry:
The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows. | ||||||
| Alerts: |
| ||||||
bind: denial of service
| Package(s): | bind | CVE #(s): | CVE-2016-6170 | ||||||||||||||||
| Created: | October 12, 2016 | Updated: | October 12, 2016 | ||||||||||||||||
| Description: | From the CVE entry:
ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
ffmpeg: not well specified
| Package(s): | ffmpeg | CVE #(s): | |||||
| Created: | October 6, 2016 | Updated: | October 12, 2016 | ||||
| Description: | The openSUSE advisory has the following information:
ffmpeg was updated to 2.8.8 to fix the following issues, both bugs and security issues: * avformat/oggparsevp8: fix pts calculation on pages ending with an invisible frame * avcodec/mjpegdec: Do not try to detect last scan but apply idct after all scans for progressive jpeg * avformat/oggparseopus: Check that granule pos is within the supported range * avformat/utils: Check bps before using it in a shift in ff_get_pcm_codec_id() * ffmpeg: Check that r_frame_rate is set before attempting to use it * avformat/utils: Do not compute the bitrate from duration == 0 * avformat/utils: Check negative bps before shifting in ff_get_pcm_codec_id() * avformat/avidec: Detect index with too short entries * avformat/oggparseopus: Fix Undefined behavior in oggparseopus.c and libavformat/utils.c * avformat/allformats: Making av_register_all() thread-safe. * avcodec/vp9_parser: Check the input frame sizes for being consistent * avformat/oggdec: Fix integer overflow with invalid pts * avcodec/ffv1enc: Fix assertion failure with non zero bits per sample * avcodec/diracdec: Check numx/y * avformat/avidec: Fix infinite loop in avi_read_nikon() | ||||||
| Alerts: |
| ||||||
freeimage: code execution
| Package(s): | freeimage | CVE #(s): | CVE-2016-5684 | ||||||||||||||||||||||||||||||||
| Created: | October 6, 2016 | Updated: | October 13, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the Debian-LTS advisory:
It was discovered that there was an out-of-bounds write vulnerability in the XMP image handling functionality in freeimage, a support library for various graphics image formats. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
ghostscript: multiple vulnerabilities
| Package(s): | ghostscript | CVE #(s): | CVE-2013-5653 CVE-2016-7976 CVE-2016-7977 CVE-2016-7978 CVE-2016-7979 CVE-2016-8602 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 12, 2016 | Updated: | February 22, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or information disclosure if a specially crafted Postscript file is processed. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
graphicsmagick: multiple vulnerabilities
| Package(s): | graphicsmagick | CVE #(s): | CVE-2016-7996 CVE-2016-7997 CVE-2016-7800 | ||||||||||||||||||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | October 12, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
Unsigned underflow leading to heap overflow when parsing 8BIM chunk (CVE-2016-7800). Two issues in the WPG reader (CVE-2016-7996, CVE-2016-7997). | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
imagemagick: two vulnerabilities
| Package(s): | imagemagick | CVE #(s): | CVE-2016-7799 CVE-2016-7906 | ||||||||||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | December 1, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
CVE-2016-7799 (denial of service): A buffer over-read vulnerability was found in ImageMagick. A malicious file could cause the application to crash. CVE-2016-7906 (arbitrary code execution): An attacker is able to trigger a use-after-free when providing a crafted image to ImageMagick's mogrify function. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
irssi: information disclosure
| Package(s): | irssi | CVE #(s): | CVE-2016-7553 | ||||||||||||||||||||||||
| Created: | October 11, 2016 | Updated: | November 28, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
An information disclosure vulnerability was found in the buf.pl core script for irssi. Other users on the same machine may be able to retrieve the whole window contents after /UPGRADE when the buf.pl script is loaded. Furthermore, this dump of the windows contents is never removed afterwards. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
kcoreaddons: HTML injection
| Package(s): | kcoreaddons | CVE #(s): | CVE-2016-7966 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | October 24, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plain text viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kde-cli-tools5: code execution
| Package(s): | kde-cli-tools5 | CVE #(s): | CVE-2016-7787 | ||||||||
| Created: | October 12, 2016 | Updated: | October 12, 2016 | ||||||||
| Description: | From the openSUSE advisory:
A user could sneak an unicode string terminator in the kdesu invocation. | ||||||||||
| Alerts: |
| ||||||||||
kernel: stack corruption
| Package(s): | kernel | CVE #(s): | CVE-2016-7039 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 11, 2016 | Updated: | October 14, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path as an unlimited recursion could unfold in both VLAN and TEB modules leading to a stack corruption in the kernel. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libdwarf: out-of-bounds read
| Package(s): | libdwarf | CVE #(s): | CVE-2016-7410 | ||||
| Created: | October 10, 2016 | Updated: | October 12, 2016 | ||||
| Description: | From the Red Hat bugzilla:
An out-of-bounds read vulnerability was found in libdwarf-20160613. | ||||||
| Alerts: |
| ||||||
libgd: denial of service
| Package(s): | libgd | CVE #(s): | CVE-2016-7568 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 12, 2016 | Updated: | October 24, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libXfixes: integer overflow
| Package(s): | libXfixes | CVE #(s): | CVE-2016-7944 | ||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | December 9, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was found that when receiving a response from the server protocol data is not validated sufficiently. The 32 bit field "rep.length" is not checked for validity, which allows an integer overflow on 32 bit systems. A malicious server could send INT_MAX as length, which gets multiplied by the size of XRectangle. In that case the client won't read the whole data from server, getting out of sync. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libXi: insufficient validation
| Package(s): | libXi | CVE #(s): | CVE-2016-7945 CVE-2016-7946 | ||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | November 11, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was found that when receiving a response from the server protocol data is not validated sufficiently. This results in integer overflows. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libXrandr: insufficient validation
| Package(s): | libXrandr | CVE #(s): | CVE-2016-7947 CVE-2016-7948 | ||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | November 2, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-7947: It was found that when receiving a response from the server protocol data is not validated sufficiently. This results in integer overflows. CVE-2016-7948: It was found that when receiving a response from the server protocol data is not validated sufficiently. This results in various data mishandlings. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libXrender: insufficient validation
| Package(s): | libXrender | CVE #(s): | CVE-2016-7949 CVE-2016-7950 | ||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | December 7, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-7949: It was found that when receiving a response from the server protocol data is not validated sufficiently. Individual lengths inside received server data can overflow the previously reserved memory. CVE-2016-7950: It was found that when receiving a response from the server protocol data is not validated sufficiently. The memory for filter names is reserved right after receiving the reply. After that, filters are iterated and each individual filter name is stored in that reserved memory. The individual name lengths are not checked for validity, which means that a malicious server can reserve less memory than it will write to during each iteration. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libXtst: insufficient validation
| Package(s): | libXtst | CVE #(s): | CVE-2016-7951 CVE-2016-7952 | ||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | December 7, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-7951: It was found that when receiving a response from the server protocol data is not validated sufficiently. This results in integer overflows. CVE-2016-7952: It was found that when receiving a response from the server protocol data is not validated sufficiently. This results in various data mishandlings. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libXv: insufficient validation
| Package(s): | libXv | CVE #(s): | CVE-2016-5407 | ||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | December 7, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was found that when receiving a response from the server protocol data is not validated sufficiently. The Xv query functions for adaptors and encodings suffer from out of boundary accesses if a hostile X server sends a maliciously crafted response. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libXvMC: insufficient validation
| Package(s): | libXvMC | CVE #(s): | CVE-2016-7953 | ||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | December 7, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was found that when receiving a response from the server protocol data is not validated sufficiently. If an empty string is received from an x-server, the buffer might underrun by accessing "rep.nameLen - 1" unconditionally, which could end up being -1. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
mat: information leak
| Package(s): | mat | CVE #(s): | |||||||||
| Created: | October 10, 2016 | Updated: | November 8, 2016 | ||||||||
| Description: | From the Debian LTS advisory:
An implementation flaw was discovered in mat, the metadata anonymisation toolkit. The implementation of PDF support lacks support to anonymize the metadata in embedded images. As there is no easy fix for this flaw, it was decided that PDF support will be removed altogether from mat for the time being. | ||||||||||
| Alerts: |
| ||||||||||
messagelib: two vulnerabilities
| Package(s): | messagelib | CVE #(s): | CVE-2016-7967 CVE-2016-7968 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | October 12, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
CVE-2016-7967 (cross-site scripting): KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled. CVE-2016-7968 (insufficient validation): KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
mujs: two vulnerabilities
| Package(s): | mujs | CVE #(s): | CVE-2016-7563 CVE-2016-7564 | ||||||||||||||||
| Created: | October 11, 2016 | Updated: | October 12, 2016 | ||||||||||||||||
| Description: | From the Red Hat bugzilla:
1. CVE-2016-7563:
mujs str Out-of-Bound read 1 byte in function chartorune.
2. CVE-2016-7564:
mujs "char *s" Heap overflow in Fp_toString at jsfunction.c:72 | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
nodejs4: two vulnerabilities
| Package(s): | nodejs4 | CVE #(s): | CVE-2016-5325 CVE-2016-7099 | ||||||||||||||||||||||||||||
| Created: | October 7, 2016 | Updated: | October 28, 2016 | ||||||||||||||||||||||||||||
| Description: | From the SUSE bug reports:
CVE-2016-5325: An unspecified low-severity Node.js HTTP processing vulnerability was found and will be fixed in latest update. Details are currently embargoed until new releases are available. CVE-2016-7099: This is a high severity defect that would allow a malicious TLS server to serve an invalid wildcard certificate for its hostname and be improperly validated by a Node.js client. This is due to a flaw in the validation of *. in the wildcard name string. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
nsd: denial of service
| Package(s): | nsd | CVE #(s): | CVE-2016-6173 | ||||
| Created: | October 12, 2016 | Updated: | October 12, 2016 | ||||
| Description: | From the Red Hat bugzilla:
It was found that NSD does not implement reasonable restrictions for zone sizes. This allows an explicitly configured primary DNS server for a zone to crash a secondary DNS server, affecting service of other zones hosted on the same secondary server. | ||||||
| Alerts: |
| ||||||
ntp: privilege escalation (distribution-specific)
| Package(s): | ntp | CVE #(s): | CVE-2016-0727 | ||||
| Created: | October 6, 2016 | Updated: | October 12, 2016 | ||||
| Description: | From the Ubuntu advisory:
It was discovered that the NTP cronjob incorrectly cleaned up the statistics directory. A local attacker could possibly use this to escalate privileges. (CVE-2016-0727) | ||||||
| Alerts: |
| ||||||
oxide-qt: denial of service
| Package(s): | oxide-qt chromium | CVE #(s): | CVE-2016-7549 | ||||
| Created: | October 7, 2016 | Updated: | October 12, 2016 | ||||
| Description: | From the CVE entry:
Google Chrome before 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) or possibly have unspecified other impact by leveraging access to a renderer process, related to render_frame_host_impl.cc and render_widget_host_impl.cc, as demonstrated by a Password Manager message. | ||||||
| Alerts: |
| ||||||
python-pillow: memory disclosure
| Package(s): | python-pillow | CVE #(s): | |||||||||
| Created: | October 10, 2016 | Updated: | October 13, 2016 | ||||||||
| Description: | From the Fedora advisory:
This update backports an overflow fix. ---- Backport fix for three memory disclosure/corruption bugs from insufficient parameter validation leading to integer overflow. | ||||||||||
| Alerts: |
| ||||||||||
qemu: three vulnerabilities
| Package(s): | qemu | CVE #(s): | CVE-2016-7161 CVE-2016-7170 CVE-2016-7908 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 11, 2016 | Updated: | October 12, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
CVE-2016-7161: Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet. CVE-2016-7170: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) is vulnerable to an OOB memory access. CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
systemd: denial of service
| Package(s): | systemd | CVE #(s): | CVE-2016-7796 | ||||||||||||||||||||
| Created: | October 10, 2016 | Updated: | January 4, 2017 | ||||||||||||||||||||
| Description: | From the SUSE advisory:
A zero-length message received over systemd's notification socket could make manager_dispatch_notify_fd() return an error and, as a side effect, disable the notification handler completely. As the notification socket is world-writable, this could have allowed a local user to perform a denial-of-service attack against systemd. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
tomcat: privilege escalation
| Package(s): | tomcat | CVE #(s): | CVE-2016-5425 CVE-2016-6325 | ||||||||||||||||||||||||||||||||||||||||
| Created: | October 11, 2016 | Updated: | November 7, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-5425) It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325) | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
tracker: denial of service
| Package(s): | tracker | CVE #(s): | |||||||||
| Created: | October 12, 2016 | Updated: | January 2, 2017 | ||||||||
| Description: | From the Ubuntu advisory:
It was discovered that Tracker incorrectly handled certain malformed GIF images. If a user or automated system were tricked into downloading a specially-crafted GIF image, Tracker could crash, resulting in a denial of service. | ||||||||||
| Alerts: |
| ||||||||||
xen: information disclosure
| Package(s): | xen | CVE #(s): | CVE-2016-6835 | ||||||||||||||||||||||||
| Created: | October 7, 2016 | Updated: | October 12, 2016 | ||||||||||||||||||||||||
| Description: | From the SUSE bug report:
Quick Emulator(Qemu) built with the VMWARE VMXNET3 NIC device support is vulnerable to an OOB read access. In that it does not check if packet headers does not check for IP header length. It could lead to a OOB access when reading further packet data. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
zendframework: SQL injection
| Package(s): | zendframework | CVE #(s): | CVE-2016-4861 | ||||||||||||||||
| Created: | October 6, 2016 | Updated: | October 24, 2016 | ||||||||||||||||
| Description: | From the Debian-LTS advisory:
CVE-2016-4861: The implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
Page editor: Jonathan Corbet
Next page:
Kernel development>>