VARIoT IoT vulnerabilities database

NetgearWNR2000 is a wireless router product from Netgear. A heap buffer overflow vulnerability exists in the NETGEARWNR2000 router. Since the router HTTP server processes *.cgi files by URL, an attacker exploiting the vulnerability can lead to a denial of service condition, leading to further attacks.

NetgearWNR2000 is a wireless router product from Netgear. An access control vulnerability exists in the NETGEARWNR2000 router. Since the apply_noauth.cgi function has similar functionality to the apply.cgi function that the administrator uses to perform sensitive operations. Unauthenticated attackers can perform sensitive operations through the apply_noauth.cgi function.

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. Cosminexus HTTP Server and Hitachi Web Server has a vulnerability (CVE-2016-8743) exists.May have unspecified impact. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. Security Fix(es): * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-2161) * A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. (CVE-2016-8740) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304. JIRA issues fixed (https://issues.jboss.org/): JBCS-318 - Errata for httpd 2.4.23 SP1 RHEL 6 7. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-10-31-8 Additional information for APPLE-SA-2017-09-25-1 macOS High Sierra 10.13 macOS High Sierra 10.13 addresses the following: 802.1X Available for: OS X Mountain Lion 10.8 and later Impact: An attacker may be able to exploit weaknesses in TLS 1.0 Description: A protocol security issue was addressed by enabling TLS 1.1 and TLS 1.2. CVE-2017-13832: an anonymous researcher Entry added October 31, 2017 apache Available for: OS X Mountain Lion 10.8 and later Impact: Multiple issues in Apache Description: Multiple issues were addressed by updating to version 2.4.27. CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 CVE-2017-9789 Entry added October 31, 2017 apache Available for: OS X Mountain Lion 10.8 and later Impact: Multiple issues in Apache Description: Multiple issues existed in Apache. These were addressed by updating Apache to version 2.4.25. CVE-2016-736 CVE-2016-2161 CVE-2016-5387 CVE-2016-8740 CVE-2016-8743 Entry added October 31, 2017 AppleScript Available for: OS X Mountain Lion 10.8 and later Impact: Decompiling an AppleScript with osadecompile may lead to arbitrary code execution Description: A validation issue was addressed with improved input sanitization. CVE-2017-13809: an anonymous researcher Entry added October 31, 2017 Application Firewall Available for: OS X Lion v10.8 and later Impact: A previously denied application firewall setting may take effect after upgrading Description: An upgrade issue existed in the handling of firewall settings. This issue was addressed through improved handling of firewall settings during upgrades. CVE-2017-7084: an anonymous researcher AppSandbox Available for: OS X Lion v10.8 and later Impact: An application may be able to cause a denial of service Description: Multiple denial of service issues were addressed through improved memory handling. CVE-2017-7074: Daniel Jalkut of Red Sweater Software ATS Available for: OS X Mountain Lion 10.8 and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2017-13820: John Villamil, Doyensec Entry added October 31, 2017 Audio Available for: OS X Mountain Lion 10.8 and later Impact: Parsing a maliciously crafted QuickTime file may lead to an unexpected application termination or arbitrary code execution Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-13807: Yangkang (@dnpushme) of Qihoo 360 Qex Team Entry added October 31, 2017 Captive Network Assistant Available for: OS X Lion v10.8 and later Impact: A local user may unknowingly send a password unencrypted over the network Description: The security state of the captive portal browser was not obvious. This issue was addressed with improved visibility of the captive portal browser security state. CVE-2017-7143: an anonymous researcher CFNetwork Proxies Available for: OS X Lion v10.8 and later Impact: An attacker in a privileged network position may be able to cause a denial of service Description: Multiple denial of service issues were addressed through improved memory handling. CVE-2017-7083: Abhinav Bansal of Zscaler Inc. CFString Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13821: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017 CoreAudio Available for: OS X Lion v10.8 and later Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed by updating to Opus version 1.1.4. CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro CoreText Available for: OS X Mountain Lion 10.8 and later Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-13825: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017 Directory Utility Available for: OS X Lion v10.8 and later Impact: A local attacker may be able to determine the Apple ID of the owner of the computer Description: A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. CVE-2017-7138: an anonymous researcher file Available for: OS X Lion v10.8 and later Impact: Multiple issues in file Description: Multiple issues were addressed by updating to version 5.30. CVE-2017-7121: found by OSS-Fuzz CVE-2017-7122: found by OSS-Fuzz CVE-2017-7123: found by OSS-Fuzz CVE-2017-7124: found by OSS-Fuzz CVE-2017-7125: found by OSS-Fuzz CVE-2017-7126: found by OSS-Fuzz file Available for: OS X Mountain Lion 10.8 and later Impact: Multiple issues in file Description: Multiple issues were addressed by updating to version 5.31. CVE-2017-13815 Entry added October 31, 2017 Fonts Available for: OS X Mountain Lion 10.8 and later Impact: Rendering untrusted text may lead to spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2017-13828: an anonymous researcher Entry added October 31, 2017 fsck_msdos Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13811: an anonymous researcher Entry added October 31, 2017 HelpViewer Available for: OS X Mountain Lion 10.8 and later Impact: A quarantined HTML file may execute arbitrary JavaScript cross-origin Description: A cross-site scripting issue existed in HelpViewer. This issue was addressed by removing the affected file. CVE-2017-13819: an anonymous researcher Entry added October 31, 2017 HFS Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum Entry added October 31, 2017 ImageIO Available for: OS X Mountain Lion 10.8 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2017-13814: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017 ImageIO Available for: OS X Mountain Lion 10.8 and later Impact: Processing a maliciously crafted image may lead to a denial of service Description: An information disclosure issue existed in the processing of disk images. This issue was addressed through improved memory management. CVE-2017-13831: an anonymous researcher Entry added October 31, 2017 Installer Available for: OS X Mountain Lion 10.8 and later Impact: A malicious application may be able to access the FileVault unlock key Description: This issue was addressed by removing additional entitlements. CVE-2017-13837: Patrick Wardle of Synack Entry added October 31, 2017 IOFireWireFamily Available for: OS X Lion v10.8 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7077: Brandon Azad IOFireWireFamily Available for: OS X Lion v10.8 and later Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-7119: Xiaolong Bai, Min (Spark) Zheng of Alibaba Inc., Benjamin Gnahm (@mitp0sh) of PDX Kernel Available for: OS X Lion v10.8 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7114: Alex Plaskett of MWR InfoSecurity Kernel Available for: OS X Mountain Lion 10.8 and later Impact: A local user may be able to leak sensitive user information Description: A permissions issue existed in kernel packet counters. This issue was addressed through improved permission validation. CVE-2017-13810: an anonymous researcher Entry added October 31, 2017 Kernel Available for: OS X Mountain Lion 10.8 and later Impact: A local user may be able to read kernel memory Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-2017-13817: Maxime Villard (m00nbsd) Entry added October 31, 2017 Kernel Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13818: The UK's National Cyber Security Centre (NCSC) CVE-2017-13836: an anonymous researcher, an anonymous researcher CVE-2017-13841: an anonymous researcher CVE-2017-13840: an anonymous researcher CVE-2017-13842: an anonymous researcher CVE-2017-13782: Kevin Backhouse of Semmle Ltd. Entry added October 31, 2017 Kernel Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13843: an anonymous researcher Entry added October 31, 2017 Kernel Available for: OS X Mountain Lion 10.8 and later Impact: Processing a malformed mach binary may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved validation. CVE-2017-13834: Maxime Villard (m00nbsd) Entry added October 31, 2017 kext tools Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A logic error in kext loading was addressed with improved state handling. CVE-2017-13827: an anonymous researcher Entry added October 31, 2017 libarchive Available for: OS X Mountain Lion 10.8 and later Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-13813: found by OSS-Fuzz CVE-2017-13816: found by OSS-Fuzz Entry added October 31, 2017 libarchive Available for: OS X Mountain Lion 10.8 and later Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: Multiple memory corruption issues existed in libarchive. These issues were addressed through improved input validation. CVE-2017-13812: found by OSS-Fuzz Entry added October 31, 2017 libarchive Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2016-4736: Proteas of Qihoo 360 Nirvan Team Entry added October 31, 2017 libc Available for: OS X Lion v10.8 and later Impact: A remote attacker may be able to cause a denial-of-service Description: A resource exhaustion issue in glob() was addressed through an improved algorithm. CVE-2017-7086: Russ Cox of Google libc Available for: OS X Lion v10.8 and later Impact: An application may be able to cause a denial of service Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-1000373 libexpat Available for: OS X Lion v10.8 and later Impact: Multiple issues in expat Description: Multiple issues were addressed by updating to version 2.2.1 CVE-2016-9063 CVE-2017-9233 Mail Available for: OS X Lion v10.8 and later Impact: The sender of an email may be able to determine the IP address of the recipient Description: Turning off "Load remote content in messages" did not apply to all mailboxes. This issue was addressed with improved setting propagation. CVE-2017-7141: an anonymous researcher Mail Drafts Available for: OS X Lion v10.8 and later Impact: An attacker with a privileged network position may be able to intercept mail contents Description: An encryption issue existed in the handling of mail drafts. This issue was addressed with improved handling of mail drafts meant to be sent encrypted. CVE-2017-7078: an anonymous researcher, an anonymous researcher, an anonymous researcher ntp Available for: OS X Lion v10.8 and later Impact: Multiple issues in ntp Description: Multiple issues were addressed by updating to version 4.2.8p10 CVE-2017-6451: Cure53 CVE-2017-6452: Cure53 CVE-2017-6455: Cure53 CVE-2017-6458: Cure53 CVE-2017-6459: Cure53 CVE-2017-6460: Cure53 CVE-2017-6462: Cure53 CVE-2017-6463: Cure53 CVE-2017-6464: Cure53 CVE-2016-9042: Matthew Van Gundy of Cisco Open Scripting Architecture Available for: OS X Mountain Lion 10.8 and later Impact: Decompiling an AppleScript with osadecompile may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13824: an anonymous researcher Entry added October 31, 2017 PCRE Available for: OS X Mountain Lion 10.8 and later Impact: Multiple issues in pcre Description: Multiple issues were addressed by updating to version 8.40. CVE-2017-13846 Entry added October 31, 2017 Postfix Available for: OS X Mountain Lion 10.8 and later Impact: Multiple issues in Postfix Description: Multiple issues were addressed by updating to version 3.2.2. CVE-2017-13826: an anonymous researcher Entry added October 31, 2017 Quick Look Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13822: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017 Quick Look Available for: OS X Mountain Lion 10.8 and later Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-7132: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017 QuickTime Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13823: an anonymous researcher Entry added October 31, 2017 Remote Management Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13808: an anonymous researcher Entry added October 31, 2017 Sandbox Available for: OS X Mountain Lion 10.8 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13838: an anonymous researcher Entry added October 31, 2017 Screen Lock Available for: OS X Lion v10.8 and later Impact: Application Firewall prompts may appear over Login Window Description: A window management issue was addressed through improved state management. CVE-2017-7082: Tim Kingman Security Available for: OS X Lion v10.8 and later Impact: A revoked certificate may be trusted Description: A certificate validation issue existed in the handling of revocation data. This issue was addressed through improved validation. CVE-2017-7080: Sven Driemecker of adesso mobile solutions gmbh, Rune Darrud (@theflyingcorpse) of BA|rum kommune, an anonymous researcher, an anonymous researcher Spotlight Available for: OS X Mountain Lion 10.8 and later Impact: Spotlight may display results for files not belonging to the user Description: An access issue existed in Spotlight. This issue was addressed through improved access restrictions. CVE-2017-13839: an anonymous researcher Entry added October 31, 2017 SQLite Available for: OS X Lion v10.8 and later Impact: Multiple issues in SQLite Description: Multiple issues were addressed by updating to version 3.19.3. CVE-2017-10989: found by OSS-Fuzz CVE-2017-7128: found by OSS-Fuzz CVE-2017-7129: found by OSS-Fuzz CVE-2017-7130: found by OSS-Fuzz SQLite Available for: OS X Lion v10.8 and later Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7127: an anonymous researcher WebKit Available for: OS X Lion v10.8 and later Impact: A malicious website may be able to track users in Safari private browsing mode Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed with improved restrictions. CVE-2017-7144: an anonymous researcher zlib Available for: OS X Lion v10.8 and later Impact: Multiple issues in zlib Description: Multiple issues were addressed by updating to version 1.2.11. CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 Installation note: macOS High Sierra 10.13 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8MpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEaV7BAA oPmo5pAA/HORVC3jl7tvStUpsUUiiez204FhuoVFsvHq0w7eYjsYDilzw7f6yveV e9Xhlbz7jhFpa1SXQhtiK5SSA1aJqhXIzZPSSf4ex/6qBZCSUrAZi1vC05TuQFi2 bvZ9N2mr3Mwd4GlxN7XZ6DLi3BqQPaKIavmuxOLkUSCpkwj9npS1oPDvMCP8DX4q goywFq4QOgvSJnohH/G8IGSm2Txy/IES68vvxdPRUi3IzjGM7E88QHkwKBDiqZRG ozuhx8Zs+cEh8yIzLO2UoTJe5gVgz1si7J4tgCPTT65r3Uf2sizkOMMdX8PHmCCi WTs3adVyJgC8nNql24cvPpJ4UM7bia0adzNf7cjTf7KKtVomIzR6IFaa+V737a+A jESOB5J0iy1oqzfGN8/zf724N+rc5jp/QejM6tTvcNuc807Z4jVpR3CEr+GkMENz Hq1Vr06gnBolmwnwlhCHujYwOpJXJ2xllQavNoe6r57XTYid1rjuRG5KXNWPlEgw GyoB8rTLY+BzLszUtrQlhh5QXa8WaQLg0uPJJDHH3DUM7jEXRBrk7nhrz4z2qq7S j1hlkhZbW2HuYg9URLhgYtkMgVjbTneZkWhEqER+AIbqFKdwTkuNgu5sHnWCrXG0 N+hmcqhXbgblWwiT0ma/I7Yn0b7O9g9stN88cL9cr3I= =887+ -----END PGP SIGNATURE----- . Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/httpd-2.4.25-i586-1_slack14.2.txz: Upgraded. This update fixes the following security issues: * CVE-2016-8740: mod_http2: Mitigate DoS memory exhaustion via endless CONTINUATION frames. * CVE-2016-5387: core: Mitigate [f]cgi "httpoxy" issues. * CVE-2016-2161: mod_auth_digest: Prevent segfaults during client entry allocation when the shared memory space is exhausted. * CVE-2016-8743: Enforce HTTP request grammar corresponding to RFC7230 for request lines and request headers, to prevent response splitting and cache pollution by malicious clients or downstream proxies. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8740 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5387 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2161 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0736 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8743 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.25-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.25-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.25-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.25-x86_64-1_slack14.1.txz Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/httpd-2.4.25-i586-1_slack14.2.txz Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/httpd-2.4.25-x86_64-1_slack14.2.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.25-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.25-x86_64-1.txz MD5 signatures: +-------------+ Slackware 14.0 package: 186e15ba143536daa3314076002c7821 httpd-2.4.25-i486-1_slack14.0.txz Slackware x86_64 14.0 package: f9eb3bf2a68a9bc8637a8d53a26ab6dd httpd-2.4.25-x86_64-1_slack14.0.txz Slackware 14.1 package: e416a15941f2c8c0eaebbd63e69164ff httpd-2.4.25-i486-1_slack14.1.txz Slackware x86_64 14.1 package: f1b4ccd7391b58bf9f78648c8c3c86b4 httpd-2.4.25-x86_64-1_slack14.1.txz Slackware 14.2 package: 18e672179bd4136eea419fbcdf1d587b httpd-2.4.25-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 250aa6c0782aefd28539e3c3f2ddde95 httpd-2.4.25-x86_64-1_slack14.2.txz Slackware -current package: 732e51e650d3287f4f415a0536c9c8fe n/httpd-2.4.25-i586-1.txz Slackware x86_64 -current package: ab4f1612c10531fce830aa1f562a9dd5 n/httpd-2.4.25-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg httpd-2.4.25-i586-1_slack14.2.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Wed, 12 Apr 2017 19:41:10 +0000 (UTC) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: httpd security and bug fix update Advisory ID: RHSA-2017:0906-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:0906 Issue date: 2017-04-12 CVE Names: CVE-2016-0736 CVE-2016-2161 CVE-2016-8743 ===================================================================== 1. Summary: An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Security Fix(es): * It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack. (CVE-2016-0736) * It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161) * It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743) Note: The fix for the CVE-2016-8743 issue causes httpd to return "400 Bad Request" error to HTTP clients which do not strictly follow HTTP protocol specification. A newly introduced configuration directive "HttpProtocolOptions Unsafe" can be used to re-enable the old less strict parsing. Bug Fix(es): * When waking up child processes during a graceful restart, the httpd parent process could attempt to open more connections than necessary if a large number of child processes had been active prior to the restart. Consequently, a graceful restart could take a long time to complete. With this update, httpd has been fixed to limit the number of connections opened during a graceful restart to the number of active children, and the described problem no longer occurs. (BZ#1420002) * Previously, httpd running in a container returned the 500 HTTP status code (Internal Server Error) when a connection to a WebSocket server was closed. As a consequence, the httpd server failed to deliver the correct HTTP status and data to a client. With this update, httpd correctly handles all proxied requests to the WebSocket server, and the described problem no longer occurs. (BZ#1429947) * In a configuration using LDAP authentication with the mod_authnz_ldap module, the name set using the AuthLDAPBindDN directive was not correctly used to bind to the LDAP server for all queries. Consequently, authorization attempts failed. The LDAP modules have been fixed to ensure the configured name is correctly bound for LDAP queries, and authorization using LDAP no longer fails. (BZ#1420047) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto 1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest 1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects 1420002 - Backport fix for issue with graceful restart taking very long time sometimes 1420047 - AuthLDAPBindDN might not be used for some LDAP searches causing LDAP authz failures 1429947 - Backport: mod_proxy_wstunnel - AH02447: err/hup on backconn 6. Package List: Red Hat Enterprise Linux Client Optional (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm aarch64: httpd-2.4.6-45.el7_3.4.aarch64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.aarch64.rpm httpd-devel-2.4.6-45.el7_3.4.aarch64.rpm httpd-tools-2.4.6-45.el7_3.4.aarch64.rpm mod_ssl-2.4.6-45.el7_3.4.aarch64.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm ppc64: httpd-2.4.6-45.el7_3.4.ppc64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.ppc64.rpm httpd-devel-2.4.6-45.el7_3.4.ppc64.rpm httpd-tools-2.4.6-45.el7_3.4.ppc64.rpm mod_ssl-2.4.6-45.el7_3.4.ppc64.rpm ppc64le: httpd-2.4.6-45.el7_3.4.ppc64le.rpm httpd-debuginfo-2.4.6-45.el7_3.4.ppc64le.rpm httpd-devel-2.4.6-45.el7_3.4.ppc64le.rpm httpd-tools-2.4.6-45.el7_3.4.ppc64le.rpm mod_ssl-2.4.6-45.el7_3.4.ppc64le.rpm s390x: httpd-2.4.6-45.el7_3.4.s390x.rpm httpd-debuginfo-2.4.6-45.el7_3.4.s390x.rpm httpd-devel-2.4.6-45.el7_3.4.s390x.rpm httpd-tools-2.4.6-45.el7_3.4.s390x.rpm mod_ssl-2.4.6-45.el7_3.4.s390x.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): aarch64: httpd-debuginfo-2.4.6-45.el7_3.4.aarch64.rpm mod_ldap-2.4.6-45.el7_3.4.aarch64.rpm mod_proxy_html-2.4.6-45.el7_3.4.aarch64.rpm mod_session-2.4.6-45.el7_3.4.aarch64.rpm ppc64: httpd-debuginfo-2.4.6-45.el7_3.4.ppc64.rpm mod_ldap-2.4.6-45.el7_3.4.ppc64.rpm mod_proxy_html-2.4.6-45.el7_3.4.ppc64.rpm mod_session-2.4.6-45.el7_3.4.ppc64.rpm ppc64le: httpd-debuginfo-2.4.6-45.el7_3.4.ppc64le.rpm mod_ldap-2.4.6-45.el7_3.4.ppc64le.rpm mod_proxy_html-2.4.6-45.el7_3.4.ppc64le.rpm mod_session-2.4.6-45.el7_3.4.ppc64le.rpm s390x: httpd-debuginfo-2.4.6-45.el7_3.4.s390x.rpm mod_ldap-2.4.6-45.el7_3.4.s390x.rpm mod_proxy_html-2.4.6-45.el7_3.4.s390x.rpm mod_session-2.4.6-45.el7_3.4.s390x.rpm x86_64: httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: httpd-2.4.6-45.el7_3.4.src.rpm noarch: httpd-manual-2.4.6-45.el7_3.4.noarch.rpm x86_64: httpd-2.4.6-45.el7_3.4.x86_64.rpm httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm httpd-devel-2.4.6-45.el7_3.4.x86_64.rpm httpd-tools-2.4.6-45.el7_3.4.x86_64.rpm mod_ssl-2.4.6-45.el7_3.4.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: httpd-debuginfo-2.4.6-45.el7_3.4.x86_64.rpm mod_ldap-2.4.6-45.el7_3.4.x86_64.rpm mod_proxy_html-2.4.6-45.el7_3.4.x86_64.rpm mod_session-2.4.6-45.el7_3.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-0736 https://access.redhat.com/security/cve/CVE-2016-2161 https://access.redhat.com/security/cve/CVE-2016-8743 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFY7n2lXlSAg2UNWIIRAn0EAJ95hoSJjNM/kZUXd8Ae6G5J3pXXHACfTIfP pb07muMthgb6w7tJ0kAuc4o= =gSHO -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . This issue was addressed by limiting the time the FileVault decryption buffers are DMA mapped to the duration of the I/O operation. CVE-2017-13804: @qwertyoruiopz at KJC Research Intl. S.R.L. 7) - noarch, x86_64 3. The httpd24 Software Collection has been upgraded to version 2.4.25, which provides a number of bug fixes and enhancements over the previous version. For detailed changes, see the Red Hat Software Collections 2.4 Release Notes linked from the References section. (CVE-2016-0736) * A denial of service flaw was found in httpd's mod_http2 module. A remote attacker could use this flaw to block server threads for long times, causing starvation of worker threads, by manipulating the flow control windows on streams. * A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash. (CVE-2016-8740) 4. ========================================================================== Ubuntu Security Notice USN-3279-1 May 09, 2017 apache2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Apache HTTP Server. Software Description: - apache2: Apache HTTP server Details: It was discovered that the Apache mod_session_crypto module was encrypting data and cookies using either CBC or ECB modes. (CVE-2016-0736) Maksim Malyutin discovered that the Apache mod_auth_digest module incorrectly handled malicious input. A new configuration option "HttpProtocolOptions Unsafe" can be used to revert to the previous unsafe behaviour in problematic environments. (CVE-2016-8743) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: apache2-bin 2.4.18-2ubuntu4.1 Ubuntu 16.04 LTS: apache2-bin 2.4.18-2ubuntu3.2 Ubuntu 14.04 LTS: apache2-bin 2.4.7-1ubuntu4.14 In general, a standard system update will make all the necessary changes

The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devices, but the vulnerability can persist on the device even after the device has been upgraded to an Android 5.1.1 or 6.0.1 build. The vulnerable system app gives a non-existent app the ability to read the notifications from the device, which a third-party app can utilize if it uses a package name of com.samsung.android.app.portalservicewidget. This vulnerability allows an unprivileged third-party app to obtain the text of the user's notifications, which tend to contain personal data. AndroidforSamsungGalaxyS6Edge is a Linux-based open source operating system developed by Samsung and the Open Handheld Device Alliance (OHA) in the United States for smartphones released by South Korea's Samsung. An attacker could exploit this vulnerability to obtain sensitive information. Multiple Samsung Galaxy Product are prone to an information-disclosure vulnerability. Information obtained may aid in further attacks

Huawei Imagine 5 is the smartphone of China Huawei. Huawei enjoys an input verification vulnerability in the 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and the application could exploit the vulnerability to send specific parameters and tamper with memory information, which in turn would lead to increased user rights.

HollySys, founded in 1993, is a provider of automation and information technology solutions. Hollysys' K-series main controller module K-CU01 has multiple denial of service vulnerabilities. (1) Distort the ulMessageSize field in the UdpComHeader structure and send a malformed packet. (2) Continuously sending data packets to the controller will cause the controller to deny service and cause the controller not to respond to normal requests.

TP-LINKTD-W8151N is a wireless router product of China TP-LINK. TP-LINKTD-W8151N has a denial of service vulnerability that could allow an attacker to cause a denial of service (program crash).

Huawei Imagine 5 is the smartphone of China Huawei. Huawei enjoys an input verification vulnerability in the 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and the application could exploit the vulnerability to send specific parameters and tamper with memory information, which in turn would lead to increased user rights.

Huawei Imagine 5 is the smartphone of China Huawei. Huawei enjoys a memory leak vulnerability in the 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and the application could exploit the vulnerability to send specific parameters, leaking system memory, and causing user information to leak.

Huawei Imagine 5 is the smartphone of China Huawei. There is an integer overflow vulnerability in Huawei's 5 mobile phone MTK platform. An attacker could convince a user to install a malicious application, and an application could exploit a vulnerability to send specific parameters, resulting in increased user rights.

An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating. WAGO 750-8202 / PFC200 and so on are all bus editable logic controller modules of German WAGO company. An authentication bypass vulnerability exists in several WAGO products. An attacker could use this vulnerability to bypass the authentication mechanism and perform unauthorized operations. This may lead to further attacks. The following products are vulnerable: WAGO 750-8202/PFC200 prior to FW04 WAGO 750-881 prior to FW09 WAGO 0758-0874-0000-0111. WAGO 750-8202/PFC200, etc

Huawei CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00 have a memory leak vulnerability. An unauthenticated attacker may send specific Label Distribution Protocol (LDP) packets to the devices. When the values of some parameters in the packet are abnormal, the LDP processing module does not release the memory to handle the packet, resulting in memory leak. Huawei CloudEngine 12800 Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. HuaweiCloudEngine12800 is the switch device of China Huawei. Multiple Huawei products are prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause denial-of-service condition. The following versions are affected: CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, and V100R006C00

An issue was discovered in Fidelix FX-20 series controllers, versions prior to 11.50.19. Arbitrary file reading via path traversal allows an attacker to access arbitrary files and directories on the server. FidelixFX-20seriescontrollers is the FX-20 series building controller from Fidelix, Finland. A directory traversal vulnerability exists in versions prior to FidelixFX-20seriescontrollers 11.50.19 that caused the program to fail to adequately filter user-submitted input. An attacker could exploit this vulnerability to obtain sensitive information. Fidelix FX-20 series controllers are prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input

A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface). Cisco CloudCenter Orchestrator is prone to a privilege-escalation vulnerability. An attacker may exploit this issue to gain root privileges on the affected device; this can also result in the attacker gaining complete control of the affected system. Cisco CloudCenter is a set of hybrid cloud management platform solutions from Cisco. The solution supports application migration, DevOps automation across multiple cloud environments, and dynamic expansion within or between clouds. Orchestrator is an orchestrator component used in it. Docker Engine is one of the container engine extensions. The vulnerability is caused by the incorrect configuration file of the program

A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. More Information: CSCus99394. Known Affected Releases: 7.3(0)ZN(0.99). An attacker can exploit this issue to gain access to the device and obtain sensitive information that may lead to further attack. This issue is being tracked by Cisco Bug ID CSCus99394. The former is a service for managing host deployments, and the latter is a virtual appliance for deploying and managing cloud providers

A vulnerability in the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to initiate connections to arbitrary hosts. More Information: CSCvc31635. Known Affected Releases: 10.6(9). Known Fixed Releases: 11.0(0). An attacker can leverage this issue to conduct phishing attacks; other attacks are possible. This issue is being tracked by Cisco bug ID CSCvc31635

NetgearR7000 is a wireless router product from Netgear. A cross-site scripting vulnerability exists in versions 1.0.7.2 through 1.1.93 of NetgearR7000 that caused the program to fail to adequately filter user-submitted input. An attacker could exploit the vulnerability to steal cookie-based authentication or inject malicious scripts.

MPSec-VPN3005S-AC is a security gateway developed by Maipu. The MPSec-VPN3005S-AC model has a weak password vulnerability. The MPSec-VPN3005S-AC model device has a default weak password vulnerability on port 23. An attacker can use the vulnerability to log in to the system and obtain server administrator permissions.

The TP-LINKTD-W8951ND is a wireless router product. A denial of service vulnerability exists in TP-LINKTD-W8951ND. Allows an attacker to exploit a vulnerability to initiate a denial of service attack.

Huawei Imagine 5 is the smartphone of China Huawei. Huawei Imagine 5 mobile Wi-Fi driver has an input verification vulnerability. An attacker could convince a user to install a malicious application that could be exploited by an application to send specific parameters to the phone, resulting in a system reboot or elevated user rights.