Security
The Internet of scary things
Are you ready for the coming toaster apocalypse? Christopher Biggs started his 2017 linux.conf.au talk on "the Internet of scary things" by noting that a lot of "Internet of things" (IoT) devices are easily broken into and turned toward evil tasks. The result can be seen in the recent attack against DNS provider Dyn that used an array of compromised video cameras. But, he said, there are things that an aware user can do to mitigate the risk that don't require giving up on connected devices in general and that, with luck, the situation is getting better.The risks associated with insecure IoT devices are serious and come in many forms. Compromised devices can be used for unauthorized information retrieval, for example. The paparazzi of the world will certainly appreciate the opportunity to look through a celebrity's camera, but stalkers, blackmailers, and nosy neighbors are also a threat. There's the threat of mass data collection that is not specifically targeted at anybody. Unauthorized control of devices is an obvious problem; pranksters have fun playing with lighting systems now, but the problem gets more severe when your front door is involved. With control systems and medical devices, the possibility of loss of life is real. It would not be funny if all the traffic lights in a city turned green at once, he said.
When identical devices are manufactured and sold in huge quantities, the
possibility for mass takeover of those devices is real. The Mirai botnet is
just one example of what can happen. These networks can be used for
denial-of-service attacks, spamming, bitcoin mining, extortion, and more.
![[Christopher
Biggs]](https://static.lwn.net/images/conf/2017/lca/ChristopherBiggs-sm.jpg "Christopher Biggs")
There is also the problem of "plain old network intrusion". Networks are
set up to deal with threats from the outside; IoT devices bring that threat
to the inside. Firewalls are
not always effective at preventing devices from tunneling out of the local
network. The monsters, he said, are in the room with us.
For extra fun, these devices are finicky to set up, difficult to manage, and generally without any provision for updates. Their security is criminally bad, to the point that he has sometimes wondered if they are deliberately malicious. Hanlon's razor suggests that the state of IoT devices can be easily attributed to stupidity instead. Laziness is also part of the problem: devices ship with debug access enabled, with hard-coded passwords, and more. All of this failure is far from new: the Morris worm in 1988 used a vector quite similar to that employed by the Mirai botnet.
Part of the problem can also be attributed to fragmentation. Each device has its own cloud service, with different apps for each device. There are lots of little walled gardens out there. This problem could be fixed within the industry and, he said, there is actually a glimmer of hope that things are moving in that direction.
Why, he asked, does everything suck? Sturgeon's law is sufficient to explain much of the problem on its own, but there is more to it than that. IoT devices are created in short product cycles using software that is not necessarily up to the task — the industry is simply not sufficiently mature yet. Fragmentation is a big problem, with each vendor wanting to lock in customers. And security is simply hard. It's easy enough to scan for vulnerable devices that nobody can rely on obscurity as a way of staying safe. A test involving putting a Mirai-vulnerable device onto the net saw the first attack arrive within 70 seconds. The threat surface is too large, especially when vendors are lazy and don't strip out unneeded software; this leads him to believe that, for many of these devices, there may be better operating systems out there than Linux. Finally, the fact that users may not even notice a compromise factors into the problem; if the buyer of a device doesn't care, the vendor won't care either.
Staying safe
The nature of IoT devices is thus pretty clear. What is less clear is how to protect oneself from the threats posed by these devices without just tossing them all into the ocean. To that end, Biggs offered a few pieces of advice for worried IoT users.
The first suggestion is to simply accept that some IoT devices will not be fit for purpose. It may be a pain to return such items, but that should be done anyway in the hope of pushing the market toward better security. It is a good idea to regularly look for unexpected devices on one's WiFi network. LG has recently announced that it will be including WiFi in every device it sells; soon one might plug in a new toaster and not realize that it has just jumped onto the local net — or established a new, open WiFi network of its own. Running port scans on devices to see what services are running also makes sense.
Do not keep devices that ask you to do unacceptable things like running untrusted software. Users will also typically have better luck if they stick to devices running on one of the "big 3" frameworks managed by Apple, Google, and Amazon. These devices should have a common management interface, minimizing the number of holes being poked in the firewall. Support for open protocols should be demanded, he said; in general, interoperability demonstrates a certain level of competence.
Even better, of course, is a device that allows the firmware to be flashed with something of the owner's choosing. He cited the Sonoff series of power-control devices as being good in this regard. Isolating devices from the network and building your own control system can prevent a lot of mischief; projects like Homebridge and Node-RED can be helpful in this regard. Checking reviews can be helpful. In general, he said, positive reviews are meaningless, but negative reviews are often valid.
Once a device has been purchased, it should be deployed safely. IoT devices should, in general, be put on their own WiFi network whenever possible. OpenWRT makes it easy to create a separate network with its own filters. Even on a poor router with factory firmware, there is usually a guest network that can be used for IoT devices. Universal plug-and-play (UPnP) can be used to automatically poke holes in the firewall; it should be turned off if possible.
One should simply plan for breaches and think about what will happen when a device goes rogue. The network used for IoT devices should have a strict deny-by-default policy. Imposing rate limiting as well can help to limit the damage a device can do. Installed devices should be checked up on occasionally; if they show a traffic spike, something unwanted may be happening.
And, again, setting up your own "cloud" can offer some advantages; this is most easily done with devices that use one of the big frameworks. Homebridge can be used to make older devices available on the Apple control network, for example. Users of Amazon's Alexa protocol may want to look into Node-RED, which can bring hundreds of devices into the Alexa sphere. Surveillance cameras, in particular, should be managed with ZoneMinder or Motion; these can replace the higher-level functions of the firmware in the camera itself, reducing the camera to a dumb peripheral.
Building your own
What if, instead, you want to develop your own IoT device? The best advice is "get someone else to do the hard parts". One choice is Apple's HomeKit API; getting approval for new devices is hard, but success means that your product is better than most. If you're not going to get official approval, consider creating a Homebridge module to serve as a backdoor into the Apple protocol. In general, Apple has taken the approach of minimizing the intelligence in the devices themselves, allowing that logic to be placed in the higher-level control software.
Working with Amazon is easier, in that Amazon doesn't require certification, but the hub hardware is only available in the US and UK currently. He is impressed with the level of security built into these products. They are built on the MQTT protocol, making it relatively easy to make your own devices that can talk to Amazon's cloud services.
In the open-source world, there has been a lot of consolidation as a number of projects have joined together into the Open Connectivity Foundation. This group is designing a set of device profiles that describe the capabilities of individual devices and let devices discover each other. This builds on "the good parts" of UPnP and the Service Location Protocol.
IoT devices should not rely on a mobile app for setup. People installing thousands of devices in a new building will thank you. Devices should support open protocols like MQTT; they are the glue that holds the IoT together. Speaking MQTT allows interoperation with a number of home-automation frameworks. MQTT can be thought of as a sort of IRC for robots, he said.
Do not forget long-term support. Everybody will lose the instructions, so devices should be self-documenting. The device should have a well-defined support life, with updates provided regularly. Finally, IoT developers need to recognize that these devices are not just miniaturized Unix PCs; they should be carefully stripped down to be sure they are not running any software that is not absolutely necessary.
Things may be getting better
There is, he said, some light at the end of the tunnel; various groups are realizing that they need to get serious about this problem. BITAG is a group founded by Google, Intel, Microsoft, and others to put together a set of recommendations on best practices. Its advice can be boiled down to "don't be lazy and stupid". The Open Connectivity Foundation is also doing good work. Bruce Schneier has been advocating for more regulation, but Biggs said that could go badly wrong. He could support regulations analogous to radio emissions testing, though.
Recently, Google shipped a developer's preview of its Android Things toolkit. It's not ready for prime time; its device profile support is limited currently. But the technology looks promising. He likes the standard camera interface in Apple's HomeKit, which allows bypassing most of the bundled firmware in such devices. Amazon's Alexa is looking good, though, he said, there is some concern about how much it listens to. The Open Connectivity Foundation has a reference framework implementation called IoTivity. It is, he said, one to watch, though he expressed concerns about the use of C as its implementation language.
One other framework worth considering is resin.io. It's open source, and has some good tools. It is based on Linux and Docker; the project can handle the containerization of an IoT application and send it out to the devices. These devices maintain a connection back to the cloud allowing for remote management and updates. The number of systems supported is relatively small at the moment, though. The project's focus is more in enterprise devices than consumer devices, but it is still worth checking out.
One app that is useful for consumers is Fing; it can be used to scan your local network. Fing is working on a small hardware device that can sit on, and monitor, a network; it will serve as a sort of intrusion detection system for networks without their own administrator. [Editor's note: potential Fing users may want to look at its privacy policy before installing the app.]
What's missing? We need to move beyond allowing devices to connect to anything they want; device profiles should be extended to describe their connectivity requirements. There is also a need to make vulnerability alerting and patch distribution work. He suspects that few members of his family are going to subscribe to Bugtraq for that purpose. Frameworks like resin.io are good for patch distribution, but it's still a centralized service; what is really needed is a common standard.
In summary, things are awful, but that's not unexpected in a "baby industry" like IoT. If buyers choose and deploy devices with care, and if builders focus on doing the job right, the worst should be avoidable. The job will get easier over the next year as the frameworks mature.
The video of this talk is available on YouTube.
[Your editor would like to thank linux.conf.au and the Linux Foundation for assisting with his travel to the event.]
Brief items
Security quotes of the week
In the long term, we need to rethink deploying deniability as a set of strategies for helping users evade coercion in general. What is similarly important is that all devices must have some sort of deniability baked-in, full stop. Adding deniable systems to devices only when that person is targeted provides little protection to at-risk populations like journalists. If it isn't baked-in to the operating system, the fact that the journalist was using some out-of-the-ordinary software itself, which may or may not have undeniable tells, would likely be a red flag and induce liberal use of the rubber hose.
I expect IoT ransomware to become a major area of crime in the next few years. How long before we see this tactic used against cars? Against home thermostats? Within the year is my guess. And as long as the ransom price isn't too onerous, people will pay.
New vulnerabilities
389-ds-base: denial of service
| Package(s): | 389-ds-base | CVE #(s): | CVE-2017-2591 | ||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the Mageia advisory:
The "attribute uniqueness" plugin did not properly NULL-terminate an array when building up its configuration if a so called 'old-style' configuration was being used. An attacker, authenticated, but possibly also unauthenticated, could possibly force the plugin to read beyond allocated memory and trigger a segfault. The crash could also possibly be triggered accidentally. | ||||||
| Alerts: |
| ||||||
ansible: password change botch
| Package(s): | ansible | CVE #(s): | CVE-2016-8647 | ||||||||
| Created: | January 26, 2017 | Updated: | February 1, 2017 | ||||||||
| Description: | From the Red Hat bugzilla entry:
It is reported that in Ansible, under some circumstances the mysql_user module may fail to correctly change a password. Thus an old password may still be active when it should have been changed. | ||||||||||
| Alerts: |
| ||||||||||
ansible: code execution
| Package(s): | ansible | CVE #(s): | CVE-2016-9587 | ||||||||||||||||
| Created: | January 26, 2017 | Updated: | February 1, 2017 | ||||||||||||||||
| Description: | From the Red Hat advisory:
An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible-server privileges. (CVE-2016-9587) This LWN article has additional details. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
chromium-browser: multiple vulnerabilities
| Package(s): | chromium-browser | CVE #(s): | CVE-2017-5006 CVE-2017-5007 CVE-2017-5008 CVE-2017-5009 CVE-2017-5010 CVE-2017-5011 CVE-2017-5012 CVE-2017-5013 CVE-2017-5014 CVE-2017-5015 CVE-2017-5016 CVE-2017-5017 CVE-2017-5018 CVE-2017-5019 CVE-2017-5020 CVE-2017-5021 CVE-2017-5022 CVE-2017-5023 CVE-2017-5024 CVE-2017-5025 CVE-2017-5026 | ||||||||||||||||||||||||||||
| Created: | January 27, 2017 | Updated: | February 20, 2017 | ||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
CVE-2017-5007 chromium-browser: universal xss in blink | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
ffmpeg: two vulnerabilities
| Package(s): | ffmpeg | CVE #(s): | CVE-2016-7122 CVE-2016-7450 | ||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the CVE entries:
The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure. (CVE-2016-7122) The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file. (CVE-2016-7450) | ||||||
| Alerts: |
| ||||||
flatpak: sandbox escape
| Package(s): | flatpak | CVE #(s): | |||||||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||||||
| Description: | From the Fedora advisory:
flatpak 0.8.2 release, fixing a security issue that could lead to sandbox escaping. For details, see https://github.com/flatpak/flatpak/releases/tag/0.8.2 | ||||||||||
| Alerts: |
| ||||||||||
ghostscript: denial of service
| Package(s): | ghostscript | CVE #(s): | CVE-2016-9601 | ||||||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||||||
| Description: | From the Red Hat bugzilla:
A heap-buffer overflow caused by integer overflow was found in ghostscript's jbig2dec-0.13 (a decoder implementation of the JBIG2 image compression format). The vulnerability is caused by an Addition-1 integer overflow. The overflowed value is passed to function ‘malloc’ as the SIZE parameter and a buffer with zero size is allocated. Later, out-of-bound read/write can happen when accessing the buffer. Whether it’s an out-of-bound read vulnerability or out-of-bound write can be controlled by crafting the input .jb2 file. The vulnerability can cause Denial-of-Service or possibly corrupt some memory data. | ||||||||||
| Alerts: |
| ||||||||||
imagemagick: multiple vulnerabilities
| Package(s): | imagemagick | CVE #(s): | CVE-2016-10144 CVE-2016-10145 CVE-2016-10146 CVE-2017-5506 CVE-2017-5507 CVE-2017-5508 CVE-2017-5510 CVE-2017-5511 | ||||||||||||||||
| Created: | January 30, 2017 | Updated: | February 17, 2017 | ||||||||||||||||
| Description: | From the Debian LTS advisory:
Numerous vulnerabilities were discovered in ImageMagick, an image manipulation program. Issues include memory leaks, out of bound reads and missing checks. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2017-5577 CVE-2017-5576 CVE-2017-5551 CVE-2017-5548 CVE-2016-10153 CVE-2017-5547 | ||||||||||||||||||||||||||||||||||||||||
| Created: | January 31, 2017 | Updated: | February 1, 2017 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Fedora advisory:
Bug #1416437 - CVE-2017-5577 kernel: vc4: Heap-buffer overflow due to failing checks. Bug #1416436 - CVE-2017-5576 kernel: vc4: Integer overflow in temporary allocation layout. Bug #1416126 - CVE-2017-5551 kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix). Bug #1416110 - CVE-2017-5548 kernel: Using stack for buffers in ieee802154. Bug #1416101 - CVE-2016-10153 kernel: introduce ceph_crypt() for in-place en/decryption. Bug #1416096 - CVE-2017-5547 kernel: DMA buffers on stack. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2004-0230 CVE-2016-9685 | ||||||||||||||||||||
| Created: | January 31, 2017 | Updated: | February 1, 2017 | ||||||||||||||||||||
| Description: | From the CVE entries:
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. (CVE-2004-0230) Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations. (CVE-2016-9685) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
lib32-openssl: three vulnerabilities
| Package(s): | lib32-openssl openssl | CVE #(s): | CVE-2016-7055 CVE-2017-3731 CVE-2017-3732 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 30, 2017 | Updated: | February 21, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-7055 (incorrect calculation): There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible erroneous outcome of public-key operations with specially crafted input. Among EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation. Impact was not analyzed in detail, because pre-requisites for attack are considered unlikely. Namely multiple clients have to choose the curve in question and the server has to share the private key among them, neither of which is default behavior. Even then only clients that chose the curve will be affected. - CVE-2017-3731 (denial of service): If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. - CVE-2017-3732 (information disclosure): There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libarchive: denial of service
| Package(s): | libarchive | CVE #(s): | CVE-2017-5601 | ||||||||
| Created: | January 31, 2017 | Updated: | February 20, 2017 | ||||||||
| Description: | From the CVE entry:
An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive. | ||||||||||
| Alerts: |
| ||||||||||
libgd2: two vulnerabilities
| Package(s): | libgd2 | CVE #(s): | CVE-2016-10167 CVE-2016-10168 | ||||||||||||||||||||||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
CVE-2016-10167: Improper handling of issing image data can cause crash CVE-2016-10168: GD2 stores the number of horizontal and vertical chunks as words (i.e. 2 byte unsigned). These values are multiplied and assigned to an int when reading the image, what can cause integer overflows. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libgd2: two vulnerabilities
| Package(s): | libgd2 | CVE #(s): | CVE-2016-6906 CVE-2016-10166 | ||||||||||||||||
| Created: | February 1, 2017 | Updated: | February 1, 2017 | ||||||||||||||||
| Description: | From the Debian advisory:
Multiple vulnerabilities have been discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed file is processed. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
libplist: two vulnerabilities
| Package(s): | libplist | CVE #(s): | CVE-2017-5209 CVE-2017-5545 | ||||||||||||
| Created: | February 1, 2017 | Updated: | February 21, 2017 | ||||||||||||
| Description: | From the CVE entries:
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. (CVE-2017-5209) The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (CVE-2017-5545) | ||||||||||||||
| Alerts: |
| ||||||||||||||
libtiff: information leak
| Package(s): | libtiff | CVE #(s): | CVE-2015-8870 | ||||||||||||||||||||
| Created: | February 1, 2017 | Updated: | February 1, 2017 | ||||||||||||||||||||
| Description: | From the CVE entry:
Integer overflow in tools/bmp2tiff.c in LibTIFF before 4.0.4 allows remote attackers to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory, via crafted width and length values in RLE4 or RLE8 data in a BMP file. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
libxpm: code execution
| Package(s): | libxpm | CVE #(s): | CVE-2016-10164 | ||||||||||||||||||||||||
| Created: | January 27, 2017 | Updated: | February 2, 2017 | ||||||||||||||||||||||||
| Description: | From the Debian advisory:
Tobias Stoeckmann discovered that the libXpm library contained two integer overflow flaws, leading to a heap out-of-bounds write, while parsing XPM extensions in a file. An attacker can provide a specially crafted XPM file that, when processed by an application using the libXpm library, would cause a denial-of-service against the application, or potentially, the execution of arbitrary code with the privileges of the user running the application. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
mbedtls: two vulnerabilities
| Package(s): | mbedtls | CVE #(s): | |||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the Mageia advisory:
The mbedtls package has been updated to version 1.3.18, which removes a non-default configuration option that could lead to session key recovery in very long TLS sessions and fixes a potential stack corruption that cannot be triggered remotely. See the mbed TLS release announcement for details. | ||||||
| Alerts: |
| ||||||
ming: multiple vulnerabilities
| Package(s): | ming | CVE #(s): | CVE-2016-9264 CVE-2016-9265 CVE-2016-9266 CVE-2016-9827 CVE-2016-9828 CVE-2016-9829 CVE-2016-9831 | ||||
| Created: | January 26, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the Debian-LTS advisory:
Multiple security issues have been found in Ming. They may lead to the execution of arbitrary code or causing application crash. CVE-2016-9264: global-buffer-overflow in printMP3Headers CVE-2016-9265: divide-by-zero in printMP3Headers CVE-2016-9266: left shift in listmp3.c CVE-2016-9827: listswf: heap-based buffer overflow in _iprintf CVE-2016-9828: listswf: heap-based buffer overflow in _iprintf CVE-2016-9829: listswf: NULL pointer dereference in dumpBuffer CVE-2016-9831: listswf: heap-based buffer overflow in parseSWF_RGBA | ||||||
| Alerts: |
| ||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox thunderbird seamonkey | CVE #(s): | CVE-2017-5374 CVE-2017-5377 CVE-2017-5379 CVE-2017-5381 CVE-2017-5382 CVE-2017-5384 CVE-2017-5385 CVE-2017-5387 CVE-2017-5388 CVE-2017-5389 CVE-2017-5391 CVE-2017-5393 | ||||||||||||||||||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2017-5374 (arbitrary code execution): Several memory safety bugs have been found in Firefox < 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-5377 (arbitrary code execution): A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable crash. - CVE-2017-5379 (arbitrary code execution): A use-after-free vulnerability has been found in Firefox < 51, in Web Animations, when interacting with cycle collection. - CVE-2017-5381 (arbitrary file overwrite): The "export" function in the Firefox < 51 Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename. - CVE-2017-5382 (information disclosure): Feed preview for RSS feeds in Firefox < 51 can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. - CVE-2017-5384 (information disclosure): Proxy Auto-Config (PAC) files in Firefox < 51 can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be sent to the proxy itself in the case of HTTPS. Normally the Proxy Auto-Config file is specified by the user or machine owner and presumed to be non-malicious, but if a user has enabled Web Proxy Auto Detect (WPAD) this file can be served remotely. - CVE-2017-5385 (information disclosure): In Firefox < 51, data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. - CVE-2017-5387 (information disclosure) The existence of a specifically requested local file can be found in Firefox < 51 due to the double firing of the onerror when the source attribute on a <track> tag refers to a file that does not exist if the source page is loaded locally. - CVE-2017-5388 (denial of service): In Firefox < 51, a STUN server in conjunction with a large number of webkitRTCPeerConnection objects can be used to send large STUN packets in a short period of time due to a lack of rate limiting being applied on e10s systems, allowing for a denial of service attack. - CVE-2017-5389 (access restriction bypass): WebExtensions in Firefox < 51 could use the mozAddonManager API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. - CVE-2017-5391 (privilege escalation): In Firefox < 51, special about: pages used by web content, such as RSS feeds, can load privileged about: pages in an iframe. If a content- injection bug were found in one of those pages this could allow for potential privilege escalation. - CVE-2017-5393 (access restriction bypass): The mozAddonManager in Firefox < 51 allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
nagios: command execution
| Package(s): | nagios | CVE #(s): | CVE-2014-5009 | ||||||||||||||||
| Created: | January 31, 2017 | Updated: | February 1, 2017 | ||||||||||||||||
| Description: | A command-execution flaw was found in the Snoopy library included with Nagios. This flaw allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
openssh: denial of service
| Package(s): | openssh | CVE #(s): | CVE-2016-8858 | ||||
| Created: | February 1, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the openSUSE advisory:
The kex_input_kexinit function in kex.c allowed remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. | ||||||
| Alerts: |
| ||||||
openssl: two vulnerabilities
| Package(s): | openssl | CVE #(s): | CVE-2016-7056 CVE-2016-8610 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 30, 2017 | Updated: | February 7, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
CVE-2016-7056: A local timing attack was discovered against ECDSA P-256. CVE-2016-8610: It was discovered that no limit was imposed on alert packets during an SSL handshake. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
puppet-swift: information disclosure
| Package(s): | puppet-swift | CVE #(s): | CVE-2016-9590 | ||||
| Created: | January 27, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the Red Hat advisory:
An information-disclosure flaw was discovered in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions. (CVE-2016-9590) | ||||||
| Alerts: |
| ||||||
ruby-archive-tar-minitar: file overwrites
| Package(s): | ruby-archive-tar-minitar | CVE #(s): | CVE-2016-10173 | ||||||||||||||||||||
| Created: | January 31, 2017 | Updated: | February 22, 2017 | ||||||||||||||||||||
| Description: | From the Debian LTS advisory:
It has been found that rubygem archive-tar-minitar allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
salt: two vulnerabilities
| Package(s): | salt | CVE #(s): | CVE-2017-5192 CVE-2017-5200 | ||||
| Created: | February 1, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the Arch Linux advisory:
- CVE-2017-5192 (arbitrary code execution): The `LocalClient.cmd_batch()` method client does not accept `external_auth` credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already- authenticated users and is only in effect when running salt-api as the `root` user. - CVE-2017-5200 (arbitrary command execution): Salt-api allows arbitrary command execution on a salt-master via Salt's ssh_client. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled. | ||||||
| Alerts: |
| ||||||
shadow-utils: two vulnerabilities
| Package(s): | shadow-utils | CVE #(s): | CVE-2016-6251 CVE-2016-6252 | ||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the Mageia advisory:
It was found that shadow-utils-4.2.1 had a potentially unsafe use of getlogin with the concern that the utmp entry might have a spoofed username associated with a correct uid (CVE-2016-6251). It was found that shadow-utils-4.2.1 had an incorrect integer handling problem where it looks like the int wrap is exploitable as a LPE, as the kernel is using 32bit uid's that are truncated from unsigned longs (64bit on x64) as returned by simple_strtoul() [map_write()]. (CVE-2016-6252). | ||||||
| Alerts: |
| ||||||
tcpdump: multiple vulnerabilities
tiff3: invalid tiff files
| Package(s): | tiff3 | CVE #(s): | |||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the Debian LTS advisory:
Version 3.9.6-11+deb7u1 and 3.9.6-11+deb7u2 introduced changes that resulted in libtiff writing out invalid tiff files when the compression scheme in use relies on codec-specific TIFF tags embedded in the image. | ||||||
| Alerts: |
| ||||||
tigervnc: code execution
| Package(s): | tigervnc | CVE #(s): | CVE-2017-5581 | ||||||||
| Created: | January 26, 2017 | Updated: | February 21, 2017 | ||||||||
| Description: | From the openSUSE advisory:
Prevent the server from overflowing a buffer in the client, causing DoS or potentially code execution. | ||||||||||
| Alerts: |
| ||||||||||
virtualbox: multiple vulnerabilities
| Package(s): | virtualbox | CVE #(s): | CVE-2016-5545 CVE-2017-3290 CVE-2017-3316 CVE-2017-3332 | ||||||||||||
| Created: | January 31, 2017 | Updated: | February 14, 2017 | ||||||||||||
| Description: | From the CVE entries:
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). (CVE-2016-5545) Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 7.9 (Integrity and Availability impacts). (CVE-2017-3290) Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). (CVE-2017-3316) Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VirtualBox SVGA Emulation). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Integrity and Availability impacts). (CVE-2017-3332) | ||||||||||||||
| Alerts: |
| ||||||||||||||
wordpress: multiple vulnerabilities
| Package(s): | wordpress | CVE #(s): | CVE-2017-5610 CVE-2017-5611 CVE-2017-5612 | ||||||||
| Created: | February 1, 2017 | Updated: | February 1, 2017 | ||||||||
| Description: | From the CVE entries:
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms. (CVE-2017-5610) SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name. (CVE-2017-5611) Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. (CVE-2017-5612) | ||||||||||
| Alerts: |
| ||||||||||
zoneminder: information leak, authentication bypass
| Package(s): | zoneminder | CVE #(s): | CVE-2016-10140 | ||||
| Created: | January 30, 2017 | Updated: | February 1, 2017 | ||||
| Description: | From the CVE entry:
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30.0, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server. | ||||||
| Alerts: |
| ||||||
Page editor: Jake Edge
Next page:
Kernel development>>