[SECURITY] [DSA 3993-1] tor security update

- ------------------------------------------------------------------------- Debian Security Advisory DSA-3993-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff October 06, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : tor CVE ID : CVE-2017-0380 It was discovered that the Tor onion service could leak sensitive information to log files if the "SafeLogging" option is set to "0". The oldstable distribution (jessie) is not affected. For the stable distribution (stretch), this problem has been fixed in version 0.2.9.12-1. We recommend that you upgrade your tor packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

[SECURITY] [DSA 3994-1] nautilus security update

Debian Security Advisory DSA-3994-1 security@debian.org https://www.debian.org/security/ Yves-Alexis Perez October 07, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : nautilus CVE ID : CVE-2017-14604 Debian Bug : 860268 Christian Boxdörfer discovered a vulnerability in the handling of FreeDesktop.org .desktop files in Nautilus, a file manager for the GNOME desktop environment. An attacker can craft a .desktop file intended to run malicious commands but displayed as a innocuous document file in Nautilus. An user would then trust it and open the file, and Nautilus would in turn execute the malicious content. Nautilus protection of only trusting .desktop files with executable permission can be bypassed by shipping the .desktop file inside a tarball. For the oldstable distribution (jessie), this problem has not been fixed yet. For the stable distribution (stretch), this problem has been fixed in version 3.22.3-1+deb9u1. For the testing distribution (buster), this problem has been fixed in version 3.26.0-1. For the unstable distribution (sid), this problem has been fixed in version 3.26.0-1. We recommend that you upgrade your nautilus packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

[SECURITY] [DSA 3995-1] libxfont security update

- ------------------------------------------------------------------------- Debian Security Advisory DSA-3995-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff October 10, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libxfont CVE ID : CVE-2017-13720 CVE-2017-13722 Two vulnerabilities were found in libXfont, the X11 font rasterisation library, which could result in denial of service or memory disclosure. For the oldstable distribution (jessie), these problems have been fixed in version 1:1.5.1-1+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 1:2.0.1-3+deb9u1. We recommend that you upgrade your libxfont packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Multiple vulnerabilities in OpenText Documentum Content Server

CVE Identifier: CVE-2017-15012 Vendor: OpenText Affected products: OpenText Documentum Content Server (all versions) Researcher: Andrey B. Panfilov CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Fix: not available Description: Opentext Documentum Content Server (formerly known as EMC Documentum Content Server) does not properly validate input of PUT_FILE RPC-command which allows any authenticated user to hijack arbitrary file from Content Server filesystem, because some files on Content Server filesystem are security-sensitive this security flaw leads to privilege escalation CVE Identifier: CVE-2017-15013 Vendor: OpenText Affected products: OpenText Documentum Content Server (all versions) Researcher: Andrey B. Panfilov CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Fix: not available Description: Opentext Documentum Content Server (formerly known as EMC Documentum Content Server) contains following design gap, which allows authenticated user to gain privileges of superuser: Content Server stores information about uploaded files in dmr_content objects, which are queryable and "editable" (before release 7.2P02 any authenticated user was able to edit dmr_content objects, now any authenticated user may delete dmr_content object and them create new one with the old identifier) by authenticated users, this allows any authenticated user to replace content of security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges CVE Identifier: CVE-2017-15014 Vendor: OpenText Affected products: OpenText Documentum Content Server (all versions) Researcher: Andrey B. Panfilov CVSS v3 Base Score: 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Fix: not available Description: Opentext Documentum Content Server (formerly known as EMC Documentum Content Server) contains following design gap, which allows authenticated user to download arbitrary content files regardless attacker's repository permissions: when authenticated user upload content to repository he performs following steps: - calls START_PUSH RPC-command - uploads file to content server - calls END_PUSH_V2 RPC-command, here Content Server returns DATA_TICKET (integer), purposed to identify the location of the uploaded file on Content Server filesystem - further user creates dmr_content object in repository, which has value of data_ticket equal to the value of DATA_TICKET received at the end of END_PUSH_V2 call As the result of such design any authenticated user may create his own dmr_content object, pointing to already existing content of Content Server filesystem CVE Identifier: CVE-2017-15276 Vendor: OpenText Affected products: OpenText Documentum Content Server (all versions) Researcher: Andrey B. Panfilov CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Fix: not available Description: Opentext Documentum Content Server (formerly known as EMC Documentum Content Server) contains following design gap, which allows authenticated user to gain privileges of superuser: Content Server allows to upload content using batches (TAR archives), when unpacking TAR archives Content Server fails to verify contents of TAR archive which causes path traversal vulnerability via symlinks, because some files on Content Server filesystem are security-sensitive this security flaw leads to privilege escalation

[RCESEC-2017-002][CVE-2017-14956] AlienVault USM v5.4.2 "/ossim/report/wizard_email.php" Cross-Site Request Forgery leading to Sensitive Information Disclosure

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: AlienVault USM Vendor URL: https://www.alienvault.com Type: Cross-Site Request Forgery [CWE-253] Date found: 2017-09-22 Date published: 2017-10-13 CVSSv3 Score: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) CVE: CVE-2017-14956 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== AlienVault USM 5.4.2 (current) older versions may be affected too. 4. INTRODUCTION =============== AlienVault Unified Security Management (USM) is a comprehensive approach to security monitoring, delivered in a unified platform. The USM platform includes five essential security capabilities that provide resource-constrained organizations with all the security essentials needed for effective threat detection, incident response, and compliance, in a single pane of glass. (from the vendor's homepage) 5. VULNERABILITY DETAILS ======================== AlienVault USM v5.4.2 offers authenticated users the functionality to generate and afterwards export generated compliance reports via the script located at "/ossim/report/wizard_email.php". Besides offering an export via a local file download, the script does also offer the possibility to send out any report via email to a given address (either in PDF or XLSX format). An exemplary request to send the pre-defined report "PCI_DSS_3_2__Vulnerability_Details" to the email address "email@example.com" looks like the following: https://example.com/ossim/report/wizard_email.php?extra_data=1&name=UENJX0RTU18zXzJfX1Z1bG5lcmFiaWxpdHlfRGV0YWlscw==&format=email&pdf=true&email=email@example.com The base64-encoded HTTP GET "name" parameter can be replaced with any other of the approx. 240 pre-defined reports, that are shipped with AlienVault USM since they do all have hardcoded identifiers, such as: - Alarm_Report - Ticket_Report - Business_and_Compliance - HIPAA_List_of_identified_ePHI_assets - PCI_DSS_3_2_Database_Users_Added - VulnerabilitiesReport etc. Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks. An exemplary exploit to send the "PCI_DSS_3_2__Vulnerability_Details" report as a PDF-file to "email@example.com" could look like the following:

6. RISK ======= To successfully exploit this vulnerability a user with rights to access the compliance reports must be tricked into visiting an arbitrary website while having an authenticated session in the application. The vulnerability allows remote attackers to trigger a report generation and send the report out to an arbitrary email address, which may lead to the disclosure of very sensitive internal reporting information stored in AlienVault USM through pre-defined reports such as: - Alarms - Assets Inventory - Compliance Reports such as PCI DSS and HIPAA - Raw Logs - Security Events - Security Operations - Tickets - User Activity 7. SOLUTION =========== None. 8. REPORT TIMELINE ================== 2017-09-22: Discovery of the vulnerability 2017-09-22: Sent full vulnerability details to publicly listed security email address 2016-10-01: MITRE assigns CVE-2017-14956 2017-10-03: No response from vendor, notified vendor again 2017-10-13: No response from vendor 2017-10-13: Public disclosure according to disclosure policy 9. REFERENCES ============= https://www.rcesecurity.com/2017/10/cve-2017-14956-alienvault-usm-leaks-sensitive-compliance-information-via-csrf https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14956

Advisory X41-2017-008: Multiple Vulnerabilities in Shadowsocks

X41 D-Sec GmbH Security Advisory: X41-2017-008 Multiple Vulnerabilities in Shadowsocks ======================================= Overview -------- Confirmed Affected Versions: Latest commit 2ab8c6b on Sep 6 Confirmed Patched Versions: N/A Vendor: Shadowsocks Vendor URL: https://github.com/shadowsocks/shadowsocks/tree/master Vector: Network Credit: X41 D-Sec GmbH, Niklas Abel Status: Public Advisory-URL: https://www.x41-dsec.de/lab/advisories/x41-2017-008-shadowsocks/ Summary and Impact ------------------ Several issues have been identified, which allow attackers to manipulate log files, execute commands and to brute force Shadowsocks with enabled autoban.py brute force detection. Brute force detection from autoban.py does not work with suggested tail command. The key of captured Shadowsocks traffic can be brute forced. Product Description ------------------- Shadowsocks is a fast tunnel proxy that helps you bypass firewalls. Log file manipulation ===================== Severity Rating: Medium Confirmed Affected Versions: Latest commit 2ab8c6b on Sep 6 Confirmed Patched Versions: N/A Vector: Network CVE: not yet issued CWE: 117 CVSS Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Summary and Impact ------------------ Log file manipulation is possible with a manipulated hostname, sent to the server from a client, even if Shadowsocks is as quiet as possible with "-qq". Therefore a string like "\nI could be any log entry\n" could be sent as hostname to Shadowsocks. The server would log an additional line with "I could be any log entry". Workarounds ----------- There is no workaround available, do not trust the logfiles until a patch is released. Command Execution ================= Severity Rating: Critical Confirmed Affected Versions: Latest commit 2ab8c6b on Sep 6 Confirmed Patched Versions: N/A Vector: Network CVE: not yet issued CWE: 78 CVSS Score: 9.0 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Summary and Impact ------------------ When the brute force detection with autoban.py is enabled, remote attackers are able to execute arbitrary commands. Command execution is possible because of because of line 53 "os.system(cmd)" in autoban.py, which executes "cmd = 'iptables -A INPUT -s %s -j DROP' % ip". The "ip" parameter gets parsed from the log file, whose contents can be controlled by a third party sending unauthenticated packets. Proof of Concept ---------------- When, a string like "can not parse header when ||ls&:\n" is sent as host name to Shadowsocks, it would end up in the logfile and lead to the execution of "ls". Autoban.py does not execute commands with spaces due to internal sanitization. A requested hostname like: " can not parse header when ||ls&:\ntouch /etc/evil.txt\nexit\ncan not parse header when ||/bin/bash log 2>log &" does not block IP's. The "for line in sys.stdin:" from autoban.py parses the input until there is an end of file (EOF). As "tail -F" will never pipe an EOF into the pyhon script, the sys.stdin will block the script forever. So the "tail -F /var/log/shodowsocks | autoban.py" will never block anything except itself. Workarounds ----------- Use python "autoban.py < /var/log/shadowsocks.log" in a cronjob. Do not use autoban.py until the command execution issue gets fixed. Bruteforcable Shadowsocks traffic because of MD5 ================================================ Confirmed Affected Versions: Latest commit 2ab8c6b on Sep 6 Confirmed Patched Versions: N/A Summary and Impact ------------------ Shadowsocks uses no brute force prevention for it's key derivation function. The key for Shadowsocks traffic encryption is static and derived from the password, using MD5. The password derivation is in encrypt.py in line 56 to 63: " while len(b''.join(m)) < (key_len + iv_len): md5 = hashlib.md5() data = password if i > 0: data = m[i - 1] + password md5.update(data) m.append(md5.digest()) i += 1 " MD5 should not be used to generate keys, since it is a hash function. A proper key derivation function increases the costs for this operation, which is a small burden for a user, but a big one for an attacker, which performs this operation many more times. As passwords usually have low-entropy, a good password derivation function has to be slow. Workarounds ----------- Use a secure password generated by a cryptographically secure random generator. Wait for a patch that uses a password based key derivation function like "Argon2" instead of a hash. About X41 D-Sec GmbH -------------------- X41 D-Sec is a provider of application security services. We focus on application code reviews, design review and security testing. X41 D-Sec GmbH was founded in 2015 by Markus Vervier. We support customers in various industries such as finance, software development and public institutions. Timeline -------- 2017-09-28 Issues found 2017-10-05 Vendor contacted 2017-10-09 Vendor contacted, replied to use GitHub for a full disclosure 2017-10-11 Vendor contacted, asked if the vendor is sure to want a full disclosure 2017-10-12 Vendor contacted, replied to create a public issue on GitHub 2017-10-13 Created public issues on GitHub 2017-10-13 Advisory release

Advisory X41-2017-010: Command Execution in Shadowsocks-libev

X41 D-Sec GmbH Security Advisory: X41-2017-010 Command Execution in Shadowsocks-libev ====================================== Overview -------- Severity Rating: High Confirmed Affected Versions: 3.1.0 Confirmed Patched Versions: N/A Vendor: Shadowsocks Vendor URL: https://github.com/shadowsocks/shadowsocks-libev Vector: Local Credit: X41 D-Sec GmbH, Niklas Abel Status: Public CVE: not yet assigned Advisory-URL: https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/ Summary and Impact ------------------ Shadowsocks-libev offers local command execution per configuration file or/and additionally, code execution per UDP request on 127.0.0.1. The configuration file on the file system or the JSON configuration received via UDP request is parsed and the arguments are passed to the "add_server" function. The function calls "construct_command_line(manager, server);" which returns a string from the parsed configuration. The string gets executed at line 486 "if (system(cmd) == -1) {", so if a configuration parameter contains "||evil command&&" within the "method" parameter, the evil command will get executed. The ss-manager uses UDP port 8830 to get control commands on 127.0.0.1. By default no authentication is required, although a password can be set with the '-k' parameter. Product Description ------------------- Shadowsocks-libev is a lightweight secured SOCKS5 proxy for embedded devices and low-end boxes. The ss-manager is meant to control Shadowsocks servers for multiple users, it spawns new servers if needed. It is a port of Shadowsocks created by @clowwindy, and maintained by @madeye and @linusyang. Proof of Concept ---------------- As passed configuration requests are getting executed, the following command will create file "evil" in /tmp/ on the server: nc -u 127.0.0.1 8839 add: {"server_port":8003, "password":"test", "method":"||touch /tmp/evil||"} The code is executed through shadowsocks-libev/src/manager.c. If the configuration file on the file system is manipulated, the code would get executed as soon as a Shadowsocks instance is started from ss-manage, as long as the malicious part of the configuration has not been overwritten. Workarounds ----------- There is no workaround available, do not use ss-manage until a patch is released. About X41 D-Sec GmbH -------------------- X41 D-Sec is a provider of application security services. We focus on application code reviews, design review and security testing. X41 D-Sec GmbH was founded in 2015 by Markus Vervier. We support customers in various industries such as finance, software development and public institutions. Timeline -------- 2017-09-28 Issues found 2017-10-05 Vendor contacted 2017-10-09 Vendor contacted, replied to use GitHub for a full disclosure 2017-10-11 Vendor contacted, asked if the vendor is sure to want a full disclosure 2017-10-12 Vendor contacted, replied to create a public issue on GitHub 2017-10-13 Created public issue on GitHub 2017-10-13 Advisory release