It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group (root:jboss, 664). On systems using classic /etc/init.d init scripts (i.e. on Red Hat Enterprise Linux 6 and earlier), the file is sourced by the jbossas init script and its content executed with root privileges when jbossas service is started, stopped or restarted.
As per upstream samba advisory:
All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon.
A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges.
A vulnerability was found in the Linux kernel in function rdsincinfocopy of file net/rds/recv.c. The last field "flags" of object "minfo" is not initialized. Copying this object out may leak kernel stack data. Assign 0 to it to avoid leak.
Upstream bug:
https://patchwork.ozlabs.org/patch/629110/
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=4116def2337991b39919f3b448326e21c40e0dbb
Last updated 24 July 2024
A certain Red Hat patch to the brdeliver function in net/bridge/brforward.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging connectivity to a network interface that uses an Ethernet bridge device.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
A flaw was found in the way ansi cprng implementation in the Linux kernel processed non-block size aligned requests. If several small requests are made that are less than the instances block size, the remainder for loop code doesn't increment randdatavalid in the last iteration, meaning that the last bytes in the randdata buffer gets reused on the subsequent smaller-than-a-block request for random data.
Acknowledgements:
Red Hat would like to thank Stephan Mueller for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation.
It was discovered that libraries shipped in sblim packages in Red Hat Enterprise Linux 4 and 5 have RPATH set pointing to a directory in a world-writable temporary directory: /var/tmp/sblim-<version>-<release>-root-brewbuilder//usr/lib . That directory existed on the build system during the package build, but is unlikely to exist on systems where sblim packages are installed.
This issue can be exploited by a local user to create fake library required by sblim libraries and execute arbitrary code with the privileges of the application using sblim such as tog-pegasus.
Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
Will Drewry of the Google Security Team reported an issue in OGG Vorbis library, that can cause crash of the application using vorbis library, trigger an infinite loop, or cause an integer overflow leading to possible heap overflow.
Problem is caused by codebooks with codebook.dim == 0.
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1036 to the following vulnerability:
International Components for Unicode (ICU) in Apple Mac OS X before 10.5.3 omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
References:
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
Proposed patch (icu part):
http://bugs.icu-project.org/trac/search?q=%22ticket:6175:%22&noquickjump=1&changeset=on
Proposed patch (icu4j part):
http://bugs.icu-project.org/trac/search?q=%22ticket:6198:%22&noquickjump=1&changeset=on
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes sendinterface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.
A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
Description of problem: gdm used to be built with tcpwrappers on previous RHEL releases, although the BuildRequires was missing there as well. The tcpwrappers package just happened to appear in the buildroot.
I believe it's nice to be able to limit XDMCP connections using hosts.{allow,deny}.
Version-Release number of selected component (if applicable): gdm-2.16.0-30.el5
Additional info: If you're going to fix this, don't forget that bug 181302 applies here as well.
A security flaw was found in PAM pamkrb5 module, providing user authentication based on Kerberos principals. A remote attacker could use this flaw to recognize, if some username/login belongs to set of user accounts, existing on the system, and subsequently perform dictionary based password guess attack.
During some routine code review last week, Alasdair Kergon spotted a security flaw in the clustered LVM daemon, clvmd. The report from him is as follows:
Clvmd, a privileged process, accepts, acts upon and responds to communications from unprivileged processes.
Background information ======================
clvmd belongs to the lvm2-cluster package and as such is normally used in shared storage clusters, where several machines are using the same disks in parallel. It is run on every machine in such a cluster. The daemon has to be enabled explictly after installing the package: it does not run by default (since RHEL4.5). Systems not running the daemon i.e. most LVM systems, not subscribed to RHN clustering channels, are not vulnerable.
Clvmd has three roles that require root privilege:
(1) Communicate with clvmd processes on other machines;
(2) Hold locks to ensure conflicting commands are not run in parallel;
(3) Make Logical Volumes available for use on the local machine by issuing the appropriate device-mapper ioctls to the kernel.
When a LVM command is issued in a cluster, an instruction is sent to the local clvmd to obtain the necessary locks and to activate or deactivate logical volumes. Any changes to the on-disk LVM metadata are performed by the original LVM process - not by clvmd itself - and then the instance of clvmd on each machine reads the updated metadata independently from disk.
The flaw ========
The problem was caused by an upstream commit made in April 2004. Prior to that, the communication between lvm and clvmd was through a socket in the filesystem, so it was protected by standard file-system security mechanisms. The commit in question changed it to use an abstract socket starting with a NUL byte (see 'man 7 unix') but no attempt was made to secure it by exchanging credentials. Consequently an unprivileged process can instruct clvmd to perform operations that were supposed to be available only to root.
Operations available to an attacker:
(1) Instruct clvmd to suspend the use of any Logical Volume visible to any machine in the cluster with immediate effect.
(2) Instruct clvmd to activate, deactivate or reload any Logical Volume visible to any machine in the cluster. (Deactivation will fail if the Logical Volume is in use.)
(3) Instruct clvmd to die.
(4) Instruct clvmd to restart (versions 2.02.64 and later).
(5) Instruct clvmd to obtain, release or report the state of locks held by the daemon.
(6) Enable/disable clvmd's debugging mode which controls the amount of detail it logs.
(7) Instruct clvmd to create a backup of a Volume Group's metadata on all the other nodes.
(8) Instruct clvmd to report the cluster name.
(9) Instruct clvmd to echo back the command it received.
(10) Instruct clvmd to refresh its internal caches.
Several of these involve performing privileged operations and could impact upon service availability on machines belonging to the cluster.
The fix ======= We are reverting to using a pathname for the socket and relying upon standard filesystem security.
Tavis Ormandy reported that seunshare, part of policycoreutils, was shipped setuid root and failed to enforce proper permissions on an alternate temporary directory mounted as /tmp. This could potentially lead to privilege escalation in certain privileged applications that assume /tmp to be sticky and root-owned.
Acknowledgements:
Red Hat would like to thank Tavis Ormandy for reporting this issue.
A security flaw was found in the way rhn-migrate-classic-to-rhsm tool of subscription-manager, a suite of tools and libraries for subscription and repository management, performed migration of system profiles, registered with Red Hat Network Classic to Customer Portal Subscription Management (certificate of Red Hat Network Classic server was not verified for validity). A rogue server could use this flaw to conduct man-in-the-middle (MiTM) attacks, possibly leading to their ability to obtain user credentials, that would be used for authentication of that particular user at Red Hat Network Classic server before the system profile(s) migration.
This issue was found by Florian Weimer of Red Hat Product Security Team.