Security
ModSecurity for web-application firewalls
Many web applications depend on a web-application firewall (WAF) as an important part of their security strategy. There are a few free-software options in the WAF space, but they are all limited in scope. The only multi-purpose project is ModSecurity, which has been around for almost 15 years now. In fact, ModSecurity is often the base that is used by commercial WAF offerings because of its flexibility and the granular control that it offers. But readers may not be familiar with ModSecurity, so an introduction to it is in order.
In 2006, the payment-card industry (PCI) mandated the use of a WAF in order to have a secure online offering, but did not specify a particular WAF implementation. That allowed many companies to offer WAFs of varying quality as the key component for PCI compliance. That variance gave WAFs a bad name; ModSecurity is one of the few brands that stands out from the rest.
It all started in 2002 when the original author, Ivan Ristić, wrote a tool to monitor application traffic in the Apache web server. Web servers do not give the administrator easy access to the request bodies and the responses. The same is true for reverse proxies that are put in front of these servers as gateways. So he wrote an Apache module that would provide this functionality and then developed a rule language to inspect said traffic and perform access control.
In 2006, Ristić sold ModSecurity but continued as a developer of it until 2009, when he left the project to pursue other ideas such as Hardenize. In 2010 ModSecurity ended up in the hands of Trustwave where it was re-licensed under the Apache license (instead of the original GPLv2). The new license made it more attractive to integrate ModSecurity into other products. That led to its adoption by various commercial vendors. Apache is at the core of many WAFs. In addition, there is now a ModSecurity module in those WAF boxes.
The license change also allowed companies to feel more comfortable porting the software to other web servers. Hence, Microsoft contributed an IIS port. The ModSecurity developers ported the code to NGINX, where it found a growing user community. Since ModSecurity was originally an Apache module, the ports were difficult to do and maintenance is painful. That is why a complete rewrite is underway. The idea is to develop ModSecurity into a standalone daemon that will communicate with the web server via an API. This daemon, which is in a functional alpha stage now, will eventually become libModSecurity 3.0. Meanwhile, the stable release branch stands at 2.9.1.
The rule language has always been part of ModSecurity; these days there is also a group of complementary features like schema validation of XML payloads, GeoIP lookup, support for remote blacklists, and even the injection of cross-site request forgery (CSRF or XSRF) tokens into the HTTP traffic.
Writing rules
But let's focus on the rule language, which is a domain-specific language for ModSecurity. The SecRule directive gives access to the full requests and responses via over one hundred different variables. Naturally, this covers all of the headers but it also allows access to individual arguments by parsing the payload of requests and responses as well. This feature also handles XML and JSON request content types, giving fine-grained access to individual parameters in the requests.
A variety of operators allow for inspection of those variables. The workhorse is the regular expression operator. But numerical comparison operators like @lt and @gt exist as well and a fast parallel-matching operator complements the set.
Depending on the return code of the operator, you can carry out a variety of actions. To deny access would be the most obvious one. But internal variables combined with persistent storage allow for a great many use cases that go beyond simple one-shot access control. HTTP is a stateless protocol up to version 1.1. ModSecurity, on the other hand, allows keeping track of a user session, caching expensive lookup operations, or communicating between different server threads in a straightforward way.
Let's look at a simple example of a rule:
SecRule ARGS:surname "!@rx ^[a-z0-9._-]*$" "id:1000,deny"
This rule inspects the surname request parameter. It helps protect the service using a whitelist of allowed characters that it enforces. The @rx defines the regular expression operator. It is negated and works on the pattern defined immediately afterward. The operator will return a match if the surname parameter contains any character outside of the set listed in the square brackets. If we have a match, the deny action comes into play: it blocks the request and returns an HTTP status code of "403 Forbidden" to the client by default. The id part of the rule is an arbitrary integer identifier that is used in other rules and for logging; it is mandatory for every rule.
The example rule could be inspecting the payload of an HTTP POST request on a registration form. There are many reasons to inspect the payload arguments before passing them to the application. Registration forms usually lead to inserts into SQL databases. Maybe we are facing a situation where an SQL-injection vulnerability was discovered in that part of the application. Our little rule would thus be meant to protect the database storage. But even if no vulnerability was discovered yet, such protection can be important. Unless you are sure that the invocation of the SQL insert statement is 100% safe, you may want to add a second layer of protection. The WAF is providing this security with rules like the one in our example.
A construct such as this also allows you to operate an insecure application with a so-called virtual patch. Virtual patching is a stupid idea — it would better fix an application than trying to lock down something known to be insecure. But as we have seen, fixing applications can take a lot of time. Besides, an in-depth security approach will assume applications are always insecure so they need to be protected with an additional layer of security.
The rule language has a lot more power than what the example above would suggest. Take the following construct as a demonstration of that: it counts the number of occurrences of individual parameters in a request and denies the request if a parameter has been submitted more than once (an attack dubbed HTTP parameter pollution):
SecRule ARGS_NAMES "@unconditionalMatch" \
"id:1001,\
pass,\
setvar:'TX.paramcounter_%{MATCHED_VAR_NAME}=+1'"
SecRule TX:/paramcounter_.*/ "@gt 1" \
"id:1002,\
deny,\
msg:'HTTP Parameter Pollution (%{TX.1})',\
chain"
SecRule MATCHED_VARS_NAMES "TX:paramcounter_(.*)" \
"capture"
The first rule builds up an internal hash and counts the number of occurrences for every parameter. The second rule cycles over the hash and checks if any of the parameter has a counter that is higher than 1. If that is the case, it manipulates the parameter name to get a well formatted alert message with the help of another chained rule and the use of regular expression back references.
Whitelisting
In 2005, firewall expert Marcus Ranum insisted that security systems need to be configured with a default deny policy on all levels. If you put that idea into practice on a WAF, you write a presumably long list of SecRule constructs like the one in our first example. You define value domains for every parameter of an application. But you will also cover the HTTP request method, the permissible HTTP headers, the cookies, and the list of acceptable location paths within the request line. You describe the application traffic down to the byte-level. This is called positive security.
ModSecurity allows for such a rule set. However, the big security benefit is overshadowed by the cost of maintenance. Because of the tight rule set, every change to the application will result in requests being blocked. That is not really practical. But in real life, there is a benefit to using partial whitelists. Such a rule set only covers parts of the application where you have identified specific threats. Perhaps in the login and registration forms, for example. There is public access to these resources. This makes them easy targets and qualifies them as a good place for a partial whitelist. Once the user has authenticated, the risk is smaller and you can decide to go without the whitelisting for the rest of the application.
Still, rule writing is hard and takes some experience. Unfortunately, the online documentation of ModSecurity is not very comprehensive. It is also scattered over multiple sites and many blog posts and tutorials. This is why the ModSecurity Handbook by Ristić has achieved a quasi-official status. The book came out in 2010 and it is now showing its age. Ristić asked me to write the second edition of the handbook. I spent the whole summer on this venture and the manuscript is now complete. While the book is being finished, you can purchase an early-access online version from the publisher, Feisty Duck.
Predefined rule sets
Given the difficulty of writing rules and the disadvantages of whitelisting rules, most people do not write their own rules. They use predefined sets of blacklist rules instead. ModSecurity blacklist rules are a series of rules that try to catch exploit payloads before they hit a server. In their basic form, these lists of patterns look like a list of Snort signatures, or they resemble a long list of exploit patterns you might find in anti-virus databases. Using the blacklist rules on a web server leads to performance problems. And like Snort or an anti-virus, you are only catching known exploits. New attacks will evade the rule set; as will re-implementations of known exploits with a different fingerprint.
So this approach has not been successful. But what is more successful is generic blacklisting. That is, inspecting the traffic and looking for signs of an attack. If you parse an argument within a request and it smells like an SQL injection, then you can deny access. SQL injections come in a variety of forms, so you will need a variety of rules to catch them. The OWASP ModSecurity Core Rule Set is a collection of rules that provides this functionality. A second article will describe this rule set and the new features provided by the CRS 3.0 release.
Brief items
Security quotes of the week
In other words, these locks all have a master key that anyone with moderate computer security skills could figure out and advertise themselves to anybody nearby. Don't buy one unless this flaw is fixed.
Infected victims of the ransomware known as Popcorn Time, have the option to either pay up, or they can opt to infect two others using a referral link. If the two new ransomware targets pay the ransom, the original target receives a free key to unlock files on their PC.
New vulnerabilities
apt: code execution
| Package(s): | apt | CVE #(s): | CVE-2016-1252 | ||||||||||||
| Created: | December 14, 2016 | Updated: | December 19, 2016 | ||||||||||||
| Description: | From the Debian advisory:
Jann Horn of Google Project Zero discovered that APT, the high level package manager, does not properly handle errors when validating signatures on InRelease files. An attacker able to man-in-the-middle HTTP requests to an apt repository that uses InRelease files (clearsigned Release files), can take advantage of this flaw to circumvent the signature of the InRelease file, leading to arbitrary code execution. | ||||||||||||||
| Alerts: |
| ||||||||||||||
atomic-openshift: information disclosure
| Package(s): | atomic-openshift | CVE #(s): | CVE-2016-8651 | ||||
| Created: | December 8, 2016 | Updated: | December 14, 2016 | ||||
| Description: | From the Red Hat advisory:
An input validation flaw was found in the way OpenShift handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image. (CVE-2016-8651) | ||||||
| Alerts: |
| ||||||
golang: denial of service
| Package(s): | golang | CVE #(s): | |||||||||||||||||
| Created: | December 13, 2016 | Updated: | January 16, 2017 | ||||||||||||||||
| Description: | From the Red Hat bugzilla:
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
gst-plugins-bad: code execution
| Package(s): | gst-plugins-bad0.10 | CVE #(s): | CVE-2016-9809 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 8, 2016 | Updated: | February 6, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian-LTS advisory:
An out of bounds heap bug was found in the H264 parser in gst-plugins-bad0.10. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
gstreamer-plugins-bad-free: two vulnerabilities
| Package(s): | gstreamer-plugins-bad-free | CVE #(s): | CVE-2016-9812 CVE-2016-9813 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 22, 2016 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-9812: An out-of-bounds heap read vulnerability was found in gst_mpegts_section_new caused by improper size checks. CVE-2016-9813: An out-of-bounds read leading to null pointer dereference vulnerability in mpegts parser in _parse_pat was found. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
gst-plugins-base: code execution
| Package(s): | gst-plugins-base0.10 | CVE #(s): | CVE-2016-9811 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 8, 2016 | Updated: | January 30, 2017 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian-LTS advisory:
An out of bounds heap read issue was found in gst-plugins-base0.10. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
httpd: denial of service
| Package(s): | httpd | CVE #(s): | CVE-2016-8740 | ||||||||||||||||||||
| Created: | December 9, 2016 | Updated: | January 27, 2017 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
The HTTP/2 protocol implementation (mod_http2) had an incomplete handling of the LimitRequestFields directive. This allowed an attacker to inject unlimited request headers into the server, leading to eventual memory exhaustion. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
jasper: multiple vulnerabilities
| Package(s): | jasper | CVE #(s): | CVE-2015-8751 CVE-2016-9262 CVE-2016-9387 CVE-2016-9388 CVE-2016-9557 CVE-2016-9560 | ||||||||||||||||||||
| Created: | December 9, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2015-8751 (denial of service): An integer overflow flaw was found in the way the JasPer's library jas_matrix_create() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.- CVE-2016-2089 (denial of service) - CVE-2016-9262 (arbitrary code execution): A number of overflows were found in jasper causing use after free vulnerability triggered by a crafted image. - CVE-2016-9387 (denial of service): An integer overflow in jpc_dec_process_siz was found that can be triggered by crafted image file when given as input to imginfo. - CVE-2016-9388 (denial of service): An improper error handling was found in the RAS encoder/decoder triggering assertion tests that result in denial of service. - CVE-2016-9557 (denial of service): A signed integer overflow vulnerability has been discovered in jas_image.c triggered by a crafted image. An option max_samples has been added to the BMP and JPEG decoders to restrict the maximum size of image that they can decode. This change was made as a (possibly temporary) fix to address security concerns. - CVE-2016-9560 (arbitrary code execution): A stack buffer overflow vulnerability has been discovered in jpc/jpc_dec.c duo to an out of bounds array write triggered by a crafted image. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
jasper: buffer overflow
| Package(s): | jasper | CVE #(s): | CVE-2016-8654 | ||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 14, 2016 | ||||||||||||||||
| Description: | From the Debian LTS advisory:
Heap-based buffer overflow in QMFB code in JPC codec. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2015-1350 CVE-2016-7917 | ||||||||||||||||||||||||||||
| Created: | December 8, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program CVE-2016-7917: The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel did not check whether a batch message's length field is large enough, which allowed local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2015-8962 CVE-2015-8963 CVE-2015-8964 CVE-2016-7913 CVE-2016-8646 CVE-2016-9178 CVE-2016-9794 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 8, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
CVE-2015-8962: Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call CVE-2015-8963: Race condition in kernel/events/core.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation CVE-2015-8964: The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a tty data structure CVE-2016-7913: The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure CVE-2016-8646: The hash_accept function in crypto/algif_hash.c in the Linux kernel allowed local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data CVE-2016-9178: The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel did not initialize a certain integer variable, which allowed local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call CVE-2016-9794: A use-after-free in ALSA pcm could lead to crashes or allowed local users to potentially gain privileges | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-9756 CVE-2016-9793 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 8, 2016 | Updated: | January 11, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) support is vulnerable to an information leakage issue. It could occur on x86 platform, while emulating instructions in 32bit mode. A user/process could use this flaw to leak host kernel memory bytes (CVE-2016-9756). A bug in SO_{SND|RCV}BUFFORCE setsockopt() implementation allows CAP_NET_ADMIN users to set negative sk_sndbuf or sk_rcvbuf values. A user could use this flaw to cause various memory corruptions, crashes and OOM (CVE-2016-9793). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-7910 CVE-2016-7911 CVE-2016-7914 CVE-2016-7916 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 9, 2016 | Updated: | February 22, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
- CVE-2016-7910: Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel allowed local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed - CVE-2016-7911: Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call - CVE-2016-7914: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel did not check whether a slot is a leaf, which allowed local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite - CVE-2016-7916: Race condition in the environ_read function in fs/proc/base.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-9777 CVE-2016-9755 | ||||||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-9777: Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) support is vulnerable to an out-of-bounds memory access issue. It could occur on x86 platform, while servicing I/O APIC requests with larger vcpu_id. A guest user/process could use this flaw to crash the host kernel resulting in DoS or it could potentially be used to escalate privileges on a host. CVE-2016-9755: A GPF in network stack was reported and traced down to negative nh offset in nf_ct_frag6_queue(). Problem is that all network headers before fragment header are pulled. Normal ipv6 reassembly will drop the skb when errors occur further down the line. netfilter doesn't do this, and instead passed the original fragment along. That was also fine back when netfilter ipv6 defrag worked with cloned fragments, as the original, pristine fragment was passed on. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
kernel: privilege escalation
| Package(s): | kernel | CVE #(s): | CVE-2016-9576 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2016-9919 | ||||||||||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||||||
| Description: | From the CVE entry:
The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libgsf: denial of service
| Package(s): | libgsf | CVE #(s): | CVE-2016-9888 | ||||||||||||||||||||
| Created: | December 12, 2016 | Updated: | January 18, 2017 | ||||||||||||||||||||
| Description: | From the CVE entry:
An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox | CVE #(s): | CVE-2016-9080 CVE-2016-9894 CVE-2016-9896 CVE-2016-9903 | ||||||||||||||||||||
| Created: | December 14, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-9080 (arbitrary code execution): Mozilla developers and community members Kan-Ru Chen, Christian Holler, and Tyson Smith reported memory safety bugs present in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2016-9894 (arbitrary code execution): A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. - CVE-2016-9896 (arbitrary code execution): Use-after-free while manipulating the navigator object within WebVR. Note: WebVR is not currently enabled by default. - CVE-2016-9903 (cross-site scripting): Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox thunderbird | CVE #(s): | CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9904 CVE-2016-9905 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 14, 2016 | Updated: | February 3, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-9893 (arbitrary code execution): Mozilla developers and community members Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky reported memory safety bugs present in Firefox 50.0.2 and Firefox ESR 45.5.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2016-9895 (access restriction bypass): Event handlers on marquee elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. - CVE-2016-9897 (arbitrary code execution): Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. - CVE-2016-9898 (arbitrary code execution): Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. - CVE-2016-9899 (arbitrary code execution): Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. - CVE-2016-9900 (information disclosure): External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of data: URLs. This could allow for cross-domain data leakage. - CVE-2016-9901 (insufficient validation): HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the about:pocket-saved (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. - CVE-2016-9902 (content spoofing): The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. - CVE-2016-9904 (information disclosure): An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
openjpeg: code execution
| Package(s): | openjpeg | CVE #(s): | CVE-2016-1923 | ||||
| Created: | December 8, 2016 | Updated: | December 14, 2016 | ||||
| Description: | From the CVE entry:
Heap-based buffer overflow in the opj_j2k_update_image_data function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image. | ||||||
| Alerts: |
| ||||||
openjpeg2: denial of service
| Package(s): | openjpeg2 | CVE #(s): | CVE-2016-9573 CVE-2016-9572 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-9572: A NULL pointer dereference flaw was found in the way openjpeg decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image. CVE-2016-9573: A heap buffer overflow flaw was found in the way openjpeg decompressed certain input images. Due to an insufficient check in the imagetopnm() function, an application using openjpeg to process image data could crash when processing a crafted image. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
openstack-cinder, openstack-glance: denial of service
| Package(s): | openstack-cinder and openstack-glance | CVE #(s): | CVE-2015-5162 | ||||||||||||||||||||||||
| Created: | December 8, 2016 | Updated: | February 16, 2017 | ||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A resource vulnerability in the Block Storage (cinder) and Image (glance) services was found in their use of qemu-img. An unprivileged user could consume as much as 4 GB of RAM on the compute host by uploading a malicious image. This flaw could lead possibly to host out-of-memory errors and negatively affect other running tenant instances. (CVE-2015-5162) | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
perl-DBD-MySQL: use after free
| Package(s): | perl-DBD-MySQL | CVE #(s): | CVE-2016-1251 | ||||||||||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||||||
| Description: | From the CVE entry
There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
php5: multiple vulnerabilities
| Package(s): | php5 | CVE #(s): | CVE-2016-9933 CVE-2016-9934 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 13, 2016 | Updated: | January 2, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | Several vulnerabilities were found in PHP. See the PHP 5.6.28 changelog for more information. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
php: unknown
| Package(s): | php | CVE #(s): | CVE-2016-9935 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 13, 2016 | Updated: | December 19, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | One of the vulnerabilities described in the PHP 5.6.29 changelog. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
php-php-gettext: code execution
| Package(s): | php-php-gettext | CVE #(s): | |||||||||||||
| Created: | December 8, 2016 | Updated: | December 14, 2016 | ||||||||||||
| Description: | From the Red Hat bugzilla entry:
A code injection vulnerability was found in php-gettext. Evaluating the plural form formula in ngettext family of calls can execute arbitrary code if number is passed unsanitized from the untrusted user. | ||||||||||||||
| Alerts: |
| ||||||||||||||
php-simplesamlphp-saml2: incorrect signature verification
| Package(s): | php-simplesamlphp-saml2 | CVE #(s): | |||||||||||||||||||||||||
| Created: | December 13, 2016 | Updated: | December 14, 2016 | ||||||||||||||||||||||||
| Description: | From the SimpleSAMLphp advisory:
The SAML2\Utils class offers a set of methods that allow to verify an XML digital signature against a given key. In particular, the validateSignature() method receives a signature and a key to verify it, and throws an exception in case there is any error, either caused by incorrect input or an invalid signature. This method uses the verify() method from the RobRichards\XMLSecDSig class to verify the signature with the given key, which in turn will end up calling openssl_verify() depending on the signature algorithm used. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
python-html5lib: cross-site scripting
| Package(s): | python-html5lib | CVE #(s): | CVE-2016-9909 CVE-2016-9910 | ||||||||||||
| Created: | December 14, 2016 | Updated: | January 4, 2017 | ||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-9909 (cross-site scripting): A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. - CVE-2016-9910 (cross-site scripting): A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. | ||||||||||||||
| Alerts: |
| ||||||||||||||
python-XStatic-jquery-ui: cross-site scripting
| Package(s): | python-XStatic-jquery-ui | CVE #(s): | CVE-2016-7103 | ||||||||||||
| Created: | December 9, 2016 | Updated: | January 20, 2017 | ||||||||||||
| Description: | From the Red Hat advisory:
It was found that a parameter of the dialog box feature of jQuery UI was vulnerable to cross site scripting. An attacker could use this flaw to execute a malicious script via the dialog box when it was displayed to a user. (CVE-2016-7103) | ||||||||||||||
| Alerts: |
| ||||||||||||||
roundcube: code execution
| Package(s): | roundcube | CVE #(s): | CVE-2016-9920 | ||||||||||||||||||||||||
| Created: | December 9, 2016 | Updated: | December 30, 2016 | ||||||||||||||||||||||||
| Description: | From the Debian-LTS advisory:
It was discovered that there was a vulnerability where a remote user could execute arbitrary commands in Roundcube, a webmail solution for IMAP servers, by sending a specially crafted email. This was due to lack of sanitisation of the arguments to PHP's "mail" function. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
spip: cross-site scripting
| Package(s): | spip | CVE #(s): | CVE-2016-9152 | ||||
| Created: | December 9, 2016 | Updated: | December 14, 2016 | ||||
| Description: | From the Debian-LTS advisory:
It was discovered that there was a cross-site scripting (XSS) vulnerability in spip, a website publishing engine, which allowed remote attackers to inject arbitrary web script or HTML via the "rac" parameter. | ||||||
| Alerts: |
| ||||||
sqlite: code execution
| Package(s): | sqlite | CVE #(s): | CVE-2015-7036 | ||||
| Created: | December 8, 2016 | Updated: | December 14, 2016 | ||||
| Description: | From the Fuzzing Project report:
Passing the command ".\" will cause a one byte heap overflow in the function resolve_backslashes(). Parsing a malformed database file will cause a heap overflow of several bytes in the function sqlite3VdbeExec(). This only matters if your attack scenario involves parsing untrusted database files. | ||||||
| Alerts: |
| ||||||
subversion: denial of service
| Package(s): | subversion | CVE #(s): | CVE-2016-8734 | ||||||||||||
| Created: | December 12, 2016 | Updated: | January 9, 2017 | ||||||||||||
| Description: | From the openSUSE bug report:
Subversion's mod_dontdothat module and clients using http(s):// are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack, otherwise known as the "billion laughs attack", targets XML parsers and can cause the targeted process to consume an excessive amount of CPU resources or memory. | ||||||||||||||
| Alerts: |
| ||||||||||||||
systemd: denial of service
| Package(s): | systemd | CVE #(s): | CVE-2013-4393 | ||||
| Created: | December 13, 2016 | Updated: | December 14, 2016 | ||||
| Description: | From the CVE entry:
journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafted file descriptor. | ||||||
| Alerts: |
| ||||||
unzip: buffer overflows
| Package(s): | unzip | CVE #(s): | CVE-2014-9913 CVE-2016-9844 | ||||||||||||||||
| Created: | December 13, 2016 | Updated: | January 13, 2017 | ||||||||||||||||
| Description: | From the Debian LTS advisory:
"unzip -l" (CVE-2014-9913) and "zipinfo" (CVE-2016-9844) were vulnerable to buffer overflows when provided malformed or maliciously-crafted ZIP files. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
w3m: multiple vulnerabilities
| Package(s): | w3m | CVE #(s): | CVE-2016-9443 CVE-2016-9621 CVE-2016-9622 CVE-2016-9623 CVE-2016-9624 CVE-2016-9625 CVE-2016-9626 CVE-2016-9627 CVE-2016-9628 CVE-2016-9629 CVE-2016-9630 CVE-2016-9631 CVE-2016-9632 CVE-2016-9633 | ||||||||
| Created: | December 14, 2016 | Updated: | December 14, 2016 | ||||||||
| Description: | From the CVE entries:
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. (CVE-2016-9443, CVE-2016-9622, CVE-2016-9623, CVE-2016-9624, CVE-2016-9625, CVE-2016-9627, CVE-2016-9628, CVE-2016-9629, CVE-2016-9631, CVE-2016-9632) Duplicate of CVE-2016-9429 (CVE-2016-9621) An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page. (CVE-2016-9626) An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (global buffer overflow and crash) via a crafted HTML page. (CVE-2016-9630) An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (infinite loop and resource consumption) via a crafted HTML page. (CVE-2016-9633) | ||||||||||
| Alerts: |
| ||||||||||
webkit-gtk: multiple vulnerabilities
| Package(s): | webkit-gtk | CVE #(s): | CVE-2014-4409 CVE-2014-4410 CVE-2014-4411 CVE-2014-4412 CVE-2014-4413 CVE-2014-4414 CVE-2014-4452 CVE-2014-4459 CVE-2014-4465 CVE-2014-4466 CVE-2014-4468 CVE-2014-4469 CVE-2014-4470 CVE-2014-4471 CVE-2014-4472 CVE-2014-4473 CVE-2014-4474 CVE-2014-4475 CVE-2014-4476 CVE-2014-4477 CVE-2014-4479 CVE-2015-1074 CVE-2015-1080 CVE-2015-1084 CVE-2015-5789 CVE-2015-5790 CVE-2015-5791 CVE-2015-5792 CVE-2015-5798 CVE-2015-5802 CVE-2015-5826 | ||||
| Created: | December 13, 2016 | Updated: | December 14, 2016 | ||||
| Description: | From the Gentoo advisory:
Multiple vulnerabilities have been discovered in WebKitGTK+. A remote attacker can use multiple vectors to execute arbitrary code or cause a Denial of Service condition. | ||||||
| Alerts: |
| ||||||
xen: privilege escalation
| Package(s): | xen | CVE #(s): | CVE-2016-9637 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 8, 2016 | Updated: | December 21, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory:
CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
xen: information disclosure
| Package(s): | xen | CVE #(s): | CVE-2016-9384 | ||||||||||||||||
| Created: | December 12, 2016 | Updated: | December 14, 2016 | ||||||||||||||||
| Description: | From the SUSE bug report:
Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load (kernel) symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused bytes were not properly cleared during symbol table loading. A malicious unprivileged guest may be able to obtain sensitive information from the host. The information leak is small and not under the control of the guest, so effectively exploiting this vulnerability is probably difficult. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
zabbix: two vulnerabilities
| Package(s): | zabbix | CVE #(s): | CVE-2016-4338 CVE-2016-9140 | ||||
| Created: | December 13, 2016 | Updated: | December 14, 2016 | ||||
| Description: | From the Gentoo advisory:
Multiple vulnerabilities have been discovered in Zabbix. A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. | ||||||
| Alerts: |
| ||||||
Page editor: Jake Edge
Next page:
Kernel development>>