An integer overflow flaw, leading to a buffer overflow, was found in the way the EVPEncodeUpdate() function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application.
A man-in-the-middle (MITM) attacker may be able to execute a padding oracle attack to decrypt traffic when a connection uses an AES-CBC cipher and the server runs on an Intel CPU supporting AES-NI. This is a common configuration for TLS servers.
The OpenSSL project has labelled this vulnerability high severity.
A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an application compiled against the OpenSSL library.
A denial of service flaw was found in the way OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input could be forced to allocate an excessive amount of data.
An integer overflow flaw, leading to a buffer overflow, was found in the way the EVPEncryptUpdate() function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application.
arch/x86/entry/entry64.S in the Linux kernel before 4.1.6 on the x8664 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.
Heap-based buffer overflow in the flxdecodedeltafli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the startline parameter.
Heap-based buffer overflow in the flxdecodedeltafli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer.
Heap-based buffer overflow in the flxdecodedeltafli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer.
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
Heap-based buffer overflow in wpasupplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.
A local user can trigger a flaw in the Linux kernel's handling of key lookups in the keychain subsystem.
The keyrejectandlink() function contains an error in which a key-lookup can fail and in an attempt to cache the failed lookup may attempt to free memory which can still be in use.
This could crash the system or at worse free a memory block which would then be re-used by another kernel mechanism causing a user after free.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1341352
Upstream patch:
https://www.spinics.net/lists/linux-kernel-janitors/msg26069.html
An issue with ASN.1 DER decoder was reported that could lead to memory corruptions, possible privilege escalation, or complete local denial of service via x509 certificate DER files.
Tags with indefinite length can be used to corrupt the dp and len pointers in asn1findindefinitelength() in lib/asn1decoder.c
Vulnerable code:
... nexttag: if (unlikely(datalen - dp < 2)) { if (datalen == dp) goto missingeoc; goto dataoverrunerror; } ... n = len - 0x80; if (unlikely(n > sizeof(sizet) - 1)) goto lengthtoolong; if (unlikely(n > datalen - dp)) goto dataoverrunerror; for (len = 0; n > 0; n--) { len <<= 8; len |= data[dp++]; } dp += len; goto nexttag; ...
dp can be corrupted and the check at nexttag is not sufficient to prevent this.
Upstream fix: https://lkml.org/lkml/2016/5/12/270
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa
A vulnerability allowing to elevate privileges from the abrt user to root was reported. If a program starting with the name "abrt" crashes, abrt-hook-ccpp will write the coredump to /var/tmp/abrt/$filename-coredump or /var/spool/abrt/$filename-coredump. From abrt-hook-ccpp.c:
if (lastslash && strncmp(++lastslash, "abrt", 4) == 0) { / If abrtd/abrt-foo crashes, we don't want to create a directory, since that can make new copy of abrtd to process it, and maybe crash again... Unlike dirs, mere files are ignored by abrtd. / if (snprintf(path, sizeof(path), "%s/%s-coredump", gsettingsdumplocation, lastslash) >= sizeof(path)) errormsganddie("Error saving '%s': truncated long file path", path);
int abrtcorefd = xopen3(path, OWRONLY | OCREAT | OTRUNC, 0600);
The call to xopen3() does not include the flag ONOFOLLOW and is therefore vulnerable to a symlink attack.
This vulnerability is not exploitable on RHEL installations with default configuration. It can be exploitable if the system is configured to use non-RHN yum repositories. This is because yum is normally not usable by non-root users if the only configured repositories are RHN.
Note: This security flaw has been split from bug #1262252.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
An out-of-bounds read in pngconverttorfc1123 in png.c was found.
Upstream bug:
http://sourceforge.net/p/libpng/bugs/241/
Upstream patch:
http://sourceforge.net/p/libpng/code/ci/fbf0f024346ca0a4ffc64b082a95c6b6bb6d29c4/
CVE assignment:
http://seclists.org/oss-sec/2015/q4/161
It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges.
Hi,
When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
$ cat test.c #include <unistd.h> #include <sys/ioctl.h>
int main() { char cmd = "id\n"; while(cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); }
$ gcc test.c -o test $ /bin/sandbox ./test id uid=1000 gid=1000 groups=1000 context=unconfinedu:unconfinedr:sandboxt:s0:c47,c176 [saken@ghetto ~]$ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken) context=unconfinedu:unconfinedr:unconfinedt:s0-s0:c0.c1023
This is similar to CVE-2016-2568, CVE-2016-2779, etc.
Thanks, Federico Bento.
Multiple vulnerabilities were found in abrt allowing privilege escalation.
==============================
1. Insecure temporary directory and symlink usage in sosreport
A vulnerability allowing to elevate privileges from an unprivileged user to root on a default installation of RHEL 7/7.1 was reported.
When a process receives SIGSEGV, abrt will save diagnostic information in /var/tmp/abrt/ccpp-$pid on RHEL 7. Unless /etc/abrt/abrt.conf contains the line "PrivateReports = yes", directories created here by abrt will be chown()'d to the user who owned the crashing process. After saving some initial information it will call post-create scripts, one of the default ones on RHEL is /usr/sbin/sosreport. /usr/sbin/sosreport will be invoked as root and work with a temporary directory named /var/tmp/abrt/ccpp-$pid/sosreport-$hostname-$date. It will save a number of files collected from the system in this directory and then archive it. Since the directory is owned by root we cannot modify files inside it while sosreport is running, but we do own the parent directory and can simply rename the temporary directory and make a new one. /usr/sbin/sosreport will then write files into our crafted temp directory and will follow any symlinks we make inside. By also renaming some of the temporary files that sosreport works with we can exploit sosreport to write a file with crafted data at an arbitrary location as root.
==============================
2. Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
A vulnerability was reported allowing to create symlinks and files at arbitrary locations as the abrt user. abrt-action-install-debuginfo-to-abrt-cache is a wrapper for abrt-action-install-debuginfo with the setuid bit for userid abrt. By default it creates a temporary directory in /var/tmp/abrt-tmp-debuginfo-RANDOMSUFFIX and downloads debug rpm files to this location before extracting them to /var/cache/abrt-di. The random suffix is not quite random but in fact highly predictable, and we can create this directory before executing the suid wrapper. By controlling the "unpacked.cpio" file we can trick abrt-action-install-debuginfo into extracting a cpio file that we control. By extracting two carefully created cpio archives we can leverage this to create files or symlinks anywhere on the file system as the abrt user.
This only works on non-redhat systems such as CentOS 7 or RHEL installations that do not use the official RHN yum repositories.
==============================
3. Insecure symlink handling in abrt-hook-ccpp
A vulnerability allowing to elevate privileges from the abrt user to root was reported. If a program starting with the name "abrt" crashes, abrt-hook-ccpp will write the coredump to /var/tmp/abrt/$filename-coredump or /var/spool/abrt/$filename-coredump. From abrt-hook-ccpp.c:
if (lastslash && strncmp(++lastslash, "abrt", 4) == 0) { / If abrtd/abrt-foo crashes, we don't want to create a directory, since that can make new copy of abrtd to process it, and maybe crash again... Unlike dirs, mere files are ignored by abrtd. / if (snprintf(path, sizeof(path), "%s/%s-coredump", gsettingsdumplocation, lastslash) >= sizeof(path)) errormsganddie("Error saving '%s': truncated long file path", path);
int abrtcorefd = xopen3(path, OWRONLY | OCREAT | OTRUNC, 0600);
The call to xopen3() does not include the flag ONOFOLLOW and is therefore vulnerable to a symlink attack.
This vulnerability is not exploitable on RHEL installations with default configuration. It can be exploitable if the system is configured to use non-RHN yum repositories. This is because yum is normally not usable by non-root users if the only configured repositories are RHN.
SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.
An underflow read was found in pngcheckkeyword in pngwutil.c in libpng-1.2.54:
If the data of "key" is only ' ' (0x20), it will read a byte before the buffer in line 1288.
This issue impacts upstream versions 1.2.55, 1.0.65, 1.4.18, and 1.5.25 of libpng.
An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image.
CVE assignment:
http://seclists.org/oss-sec/2015/q4/469
Upstream issue:
http://sourceforge.net/p/libpng/bugs/244/
Upstream patch:
http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b42ed/
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1690.
Integer signedness error in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
Multiple integer signedness errors in the pcfgetencodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.
sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.
The MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.