Date: Thu, 11 Aug 2016 21:34:00 +0000 (UTC) From: Mark Felder <feld@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r420108 - head/security/vuxml Message-ID: <201608112134.u7BLY0RB095413@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: feld Date: Thu Aug 11 21:33:59 2016 New Revision: 420108 URL: https://svnweb.freebsd.org/changeset/ports/420108 Log: Add missing FreeBSD SA entries from 2016 to vuxml Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Aug 11 21:27:28 2016 (r420107) +++ head/security/vuxml/vuln.xml Thu Aug 11 21:33:59 2016 (r420108) @@ -58,6 +58,581 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="7d4f4955-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Heap vulnerability in bspatch</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>10.3</ge><lt>10.3_6</lt></range> + <range><ge>10.2</ge><lt>10.2_20</lt></range> + <range><ge>10.1</ge><lt>10.1_37</lt></range> + <range><ge>9.3</ge><lt>9.3_45</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>The implementation of bspatch does not check for a + negative value on numbers of bytes read from the diff and + extra streams, allowing an attacker who can control the + patch file to write at arbitrary locations in the heap.</p> + <p>This issue was first discovered by The Chromium Project + and reported independently by Lu Tung-Pin to the FreeBSD + project.</p> + <h1>Impact:</h1> + <p>An attacker who can control the patch file can cause a + crash or run arbitrary code under the credentials of the + user who runs bspatch, in many cases, root.</p> + </body> + </description> + <references> + <cvename>CVE-2014-9862</cvename> + <freebsdsa>FreeBSD-SA-16:25.bspatch</freebsdsa> + </references> + <dates> + <discovery>2016-07-25</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7cfcea05-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Multiple vulnerabilities of ntp</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>10.3</ge><lt>10.3_5</lt></range> + <range><ge>10.2</ge><lt>10.2_19</lt></range> + <range><ge>10.1</ge><lt>10.1_36</lt></range> + <range><ge>9.3</ge><lt>9.3_44</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>Multiple vulnerabilities have been discovered in the NTP + suite:</p> + <p>The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that + could cause ntpd to crash. [CVE-2016-4957, Reported by + Nicolas Edet of Cisco]</p> + <p>An attacker who knows the origin timestamp and can send + a spoofed packet containing a CRYPTO-NAK to an ephemeral + peer target before any other response is sent can demobilize + that association. [CVE-2016-4953, Reported by Miroslav + Lichvar of Red Hat]</p> + <p>An attacker who is able to spoof packets with correct + origin timestamps from enough servers before the expected + response packets arrive at the target machine can affect + some peer variables and, for example, cause a false leap + indication to be set. [CVE-2016-4954, Reported by Jakub + Prokes of Red Hat]</p> + <p>An attacker who is able to spoof a packet with a correct + origin timestamp before the expected response packet arrives + at the target machine can send a CRYPTO_NAK or a bad MAC + and cause the association's peer variables to be cleared. + If this can be done often enough, it will prevent that + association from working. [CVE-2016-4955, Reported by + Miroslav Lichvar of Red Hat]</p> + <p>The fix for NtpBug2978 does not cover broadcast associations, + so broadcast clients can be triggered to flip into interleave + mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red + Hat.]</p> + <h1>Impact:</h1> + <p>Malicious remote attackers may be able to break time + synchronization, or cause the ntpd(8) daemon to crash.</p> + </body> + </description> + <references> + <cvename>CVE-2016-4953</cvename> + <cvename>CVE-2016-4954</cvename> + <cvename>CVE-2016-4955</cvename> + <cvename>CVE-2016-4956</cvename> + <cvename>CVE-2016-4957</cvename> + <freebsdsa>FreeBSD-SA-16:24.ntp</freebsdsa> + </references> + <dates> + <discovery>2016-06-04</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7cad4795-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.3</ge><lt>10.3_4</lt></range> + <range><ge>10.2</ge><lt>10.2_18</lt></range> + <range><ge>10.1</ge><lt>10.1_35</lt></range> + <range><ge>9.3</ge><lt>9.3_43</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>The implementation of historic stat(2) system call does + not clear the output struct before copying it out to + userland.</p> + <h1>Impact:</h1> + <p>An unprivileged user can read a portion of uninitialised + kernel stack data, which may contain sensitive information, + such as the stack guard, portions of the file cache or + terminal buffers, which an attacker might leverage to obtain + elevated privileges.</p> + </body> + </description> + <references> + <freebsdsa>FreeBSD-SA-16:21.43bsd</freebsdsa> + </references> + <dates> + <discovery>2016-05-31</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7c5d64dd-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Kernel stack disclosure in Linux compatibility layer</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.3</ge><lt>10.3_4</lt></range> + <range><ge>10.2</ge><lt>10.2_18</lt></range> + <range><ge>10.1</ge><lt>10.1_35</lt></range> + <range><ge>9.3</ge><lt>9.3_43</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>The implementation of the TIOCGSERIAL ioctl(2) does not + clear the output struct before copying it out to userland.</p> + <p>The implementation of the Linux sysinfo() system call + does not clear the output struct before copying it out to + userland.</p> + <h1>Impact:</h1> + <p>An unprivileged user can read a portion of uninitialised + kernel stack data, which may contain sensitive information, + such as the stack guard, portions of the file cache or + terminal buffers, which an attacker might leverage to obtain + elevated privileges.</p> + </body> + </description> + <references> + <freebsdsa>FreeBSD-SA-16:20.linux</freebsdsa> + </references> + <dates> + <discovery>2016-05-31</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7c0bac69-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Incorrect argument handling in sendmsg(2)</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.3</ge><lt>10.3_3</lt></range> + <range><ge>10.2</ge><lt>10.2_17</lt></range> + <range><ge>10.1</ge><lt>10.1_34</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>Incorrect argument handling in the socket code allows + malicious local user to overwrite large portion of the + kernel memory.</p> + <h1>Impact:</h1> + <p>Malicious local user may crash kernel or execute arbitrary + code in the kernel, potentially gaining superuser privileges.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1887</cvename> + <freebsdsa>FreeBSD-SA-16:19.sendmsg</freebsdsa> + </references> + <dates> + <discovery>2016-05-17</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7bbc0e8c-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Buffer overflow in keyboard driver</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.3</ge><lt>10.3_3</lt></range> + <range><ge>10.2</ge><lt>10.2_17</lt></range> + <range><ge>10.1</ge><lt>10.1_34</lt></range> + <range><ge>9.3</ge><lt>9.3_42</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>Incorrect signedness comparison in the ioctl(2) handler + allows a malicious local user to overwrite a portion of the + kernel memory.</p> + <h1>Impact:</h1> + <p>A local user may crash the kernel, read a portion of + kernel memory and execute arbitrary code in kernel context. + The result of executing an arbitrary kernel code is privilege + escalation.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1886</cvename> + <freebsdsa>FreeBSD-SA-16:18.atkbd</freebsdsa> + </references> + <dates> + <discovery>2016-05-17</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7b6a11b5-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Incorrect argument validation in sysarch(2)</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.2</ge><lt>10.2_14</lt></range> + <range><ge>10.1</ge><lt>10.1_31</lt></range> + <range><ge>9.3</ge><lt>9.3_39</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A special combination of sysarch(2) arguments, specify + a request to uninstall a set of descriptors from the LDT. + The start descriptor is cleared and the number of descriptors + are provided. Due to invalid use of a signed intermediate + value in the bounds checking during argument validity + verification, unbound zero'ing of the process LDT and + adjacent memory can be initiated from usermode.</p> + <h1>Impact:</h1> + <p>This vulnerability could cause the kernel to panic. In + addition it is possible to perform a local Denial of Service + against the system by unprivileged processes.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1885</cvename> + <freebsdsa>FreeBSD-SA-16:15.sysarch</freebsdsa> + </references> + <dates> + <discovery>2016-03-16</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7b1a4a27-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Multiple OpenSSL vulnerabilities</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>10.2</ge><lt>10.2_13</lt></range> + <range><ge>10.1</ge><lt>10.1_30</lt></range> + <range><ge>9.3</ge><lt>9.3_38</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A cross-protocol attack was discovered that could lead + to decryption of TLS sessions by using a server supporting + SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA + padding oracle. Note that traffic between clients and + non-vulnerable servers can be decrypted provided another + server supporting SSLv2 and EXPORT ciphers (even with a + different protocol such as SMTP, IMAP or POP3) shares the + RSA keys of the non-vulnerable server. This vulnerability + is known as DROWN. [CVE-2016-0800]</p> + <p>A double free bug was discovered when OpenSSL parses + malformed DSA private keys and could lead to a DoS attack + or memory corruption for applications that receive DSA + private keys from untrusted sources. This scenario is + considered rare. [CVE-2016-0705]</p> + <p>The SRP user database lookup method SRP_VBASE_get_by_user + had confusing memory management semantics; the returned + pointer was sometimes newly allocated, and sometimes owned + by the callee. The calling code has no way of distinguishing + these two cases. [CVE-2016-0798]</p> + <p>In the BN_hex2bn function, the number of hex digits is + calculated using an int value |i|. Later |bn_expand| is + called with a value of |i * 4|. For large values of |i| + this can result in |bn_expand| not allocating any memory + because |i * 4| is negative. This can leave the internal + BIGNUM data field as NULL leading to a subsequent NULL + pointer dereference. For very large values of |i|, the + calculation |i * 4| could be a positive value smaller than + |i|. In this case memory is allocated to the internal BIGNUM + data field, but it is insufficiently sized leading to heap + corruption. A similar issue exists in BN_dec2bn. This could + have security consequences if BN_hex2bn/BN_dec2bn is ever + called by user applications with very large untrusted hex/dec + data. This is anticipated to be a rare occurrence. + [CVE-2016-0797]</p> + <p>The internal |fmtstr| function used in processing a "%s" + formatted string in the BIO_*printf functions could overflow + while calculating the length of a string and cause an + out-of-bounds read when printing very long strings. + [CVE-2016-0799]</p> + <p>A side-channel attack was found which makes use of + cache-bank conflicts on the Intel Sandy-Bridge microarchitecture + which could lead to the recovery of RSA keys. [CVE-2016-0702]</p> + <p>s2_srvr.c did not enforce that clear-key-length is 0 for + non-export ciphers. If clear-key bytes are present for these + ciphers, they displace encrypted-key bytes. [CVE-2016-0703]</p> + <p>s2_srvr.c overwrites the wrong bytes in the master key + when applying Bleichenbacher protection for export cipher + suites. [CVE-2016-0704]</p> + <h1>Impact:</h1> + <p>Servers that have SSLv2 protocol enabled are vulnerable + to the "DROWN" attack which allows a remote attacker to + fast attack many recorded TLS connections made to the server, + even when the client did not make any SSLv2 connections + themselves.</p> + <p>An attacker who can supply malformed DSA private keys + to OpenSSL applications may be able to cause memory corruption + which would lead to a Denial of Service condition. + [CVE-2016-0705]</p> + <p>An attacker connecting with an invalid username can cause + memory leak, which could eventually lead to a Denial of + Service condition. [CVE-2016-0798]</p> + <p>An attacker who can inject malformed data into an + application may be able to cause memory corruption which + would lead to a Denial of Service condition. [CVE-2016-0797, + CVE-2016-0799]</p> + <p>A local attacker who has control of code in a thread + running on the same hyper-threaded core as the victim thread + which is performing decryptions could recover RSA keys. + [CVE-2016-0702]</p> + <p>An eavesdropper who can intercept SSLv2 handshake can + conduct an efficient divide-and-conquer key recovery attack + and use the server as an oracle to determine the SSLv2 + master-key, using only 16 connections to the server and + negligible computation. [CVE-2016-0703]</p> + <p>An attacker can use the Bleichenbacher oracle, which + enables more efficient variant of the DROWN attack. + [CVE-2016-0704]</p> + </body> + </description> + <references> + <cvename>CVE-2016-0702</cvename> + <cvename>CVE-2016-0703</cvename> + <cvename>CVE-2016-0704</cvename> + <cvename>CVE-2016-0705</cvename> + <cvename>CVE-2016-0797</cvename> + <cvename>CVE-2016-0798</cvename> + <cvename>CVE-2016-0799</cvename> + <cvename>CVE-2016-0800</cvename> + <freebsdsa>FreeBSD-SA-16:12.openssl</freebsdsa> + </references> + <dates> + <discovery>2016-03-10</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7ac28df1-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Linux compatibility layer issetugid(2) system call</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.2</ge><lt>10.2_11</lt></range> + <range><ge>10.1</ge><lt>10.1_28</lt></range> + <range><ge>9.3</ge><lt>9.3_35</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A programming error in the Linux compatibility layer + could cause the issetugid(2) system call to return incorrect + information.</p> + <h1>Impact:</h1> + <p>If an application relies on output of the issetugid(2) + system call and that information is incorrect, this could + lead to a privilege escalation.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1883</cvename> + <freebsdsa>FreeBSD-SA-16:10.linux</freebsdsa> + </references> + <dates> + <discovery>2016-01-27</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="7a31dfba-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Insecure default snmpd.config permissions</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>10.2</ge><lt>10.2_9</lt></range> + <range><ge>10.1</ge><lt>10.1_26</lt></range> + <range><ge>9.3</ge><lt>9.3_33</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>The SNMP protocol supports an authentication model called + USM, which relies on a shared secret. The default permission + of the snmpd.configiguration file, /etc/snmpd.config, is + weak and does not provide adequate protection against local + unprivileged users.</p> + <h1>Impact:</h1> + <p>A local user may be able to read the shared secret, if + configured and used by the system administrator.</p> + </body> + </description> + <references> + <cvename>CVE-2015-5677</cvename> + <freebsdsa>FreeBSD-SA-16:06.bsnmpd</freebsdsa> + </references> + <dates> + <discovery>2016-01-14</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="79dfc135-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- TCP MD5 signature denial of service</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.2</ge><lt>10.2_9</lt></range> + <range><ge>10.1</ge><lt>10.1_26</lt></range> + <range><ge>9.3</ge><lt>9.3_33</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A programming error in processing a TCP connection with + both TCP_MD5SIG and TCP_NOOPT socket options may lead to + kernel crash.</p> + <h1>Impact:</h1> + <p>A local attacker can crash the kernel, resulting in a + denial-of-service.</p> + <p>A remote attack is theoretically possible, if server has + a listening socket with TCP_NOOPT set, and server is either + out of SYN cache entries, or SYN cache is disabled by + configuration.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1882</cvename> + <freebsdsa>FreeBSD-SA-16:05.tcp</freebsdsa> + </references> + <dates> + <discovery>2016-01-14</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="798f63e0-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Linux compatibility layer setgroups(2) system call</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.2</ge><lt>10.2_9</lt></range> + <range><ge>10.1</ge><lt>10.1_26</lt></range> + <range><ge>9.3</ge><lt>9.3_33</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A programming error in the Linux compatibility layer + setgroups(2) system call can lead to an unexpected results, + such as overwriting random kernel memory contents.</p> + <h1>Impact:</h1> + <p>It is possible for a local attacker to overwrite portions + of kernel memory, which may result in a privilege escalation + or cause a system panic.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1881</cvename> + <freebsdsa>FreeBSD-SA-16:04.linux</freebsdsa> + </references> + <dates> + <discovery>2016-01-14</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="793fb19c-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- Linux compatibility layer incorrect futex handling</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.2</ge><lt>10.2_9</lt></range> + <range><ge>10.1</ge><lt>10.1_26</lt></range> + <range><ge>9.3</ge><lt>9.3_33</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A programming error in the handling of Linux futex robust + lists may result in incorrect memory locations being + accessed.</p> + <h1>Impact:</h1> + <p>It is possible for a local attacker to read portions of + kernel memory, which may result in a privilege escalation.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1880</cvename> + <freebsdsa>FreeBSD-SA-16:03.linux</freebsdsa> + </references> + <dates> + <discovery>2016-01-14</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + + <vuln vid="78f06a6c-600a-11e6-a6c3-14dae9d210b8"> + <topic>FreeBSD -- SCTP ICMPv6 error message vulnerability</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>10.2</ge><lt>10.2_9</lt></range> + <range><ge>10.1</ge><lt>10.1_26</lt></range> + <range><ge>9.3</ge><lt>9.3_33</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A lack of proper input checks in the ICMPv6 processing + in the SCTP stack can lead to either a failed kernel assertion + or to a NULL pointer dereference. In either case, a kernel + panic will follow.</p> + <h1>Impact:</h1> + <p>A remote, unauthenticated attacker can reliably trigger + a kernel panic in a vulnerable system running IPv6. Any + kernel compiled with both IPv6 and SCTP support is vulnerable. + There is no requirement to have an SCTP socket open.</p> + <p>IPv4 ICMP processing is not impacted by this vulnerability.</p> + </body> + </description> + <references> + <cvename>CVE-2016-1879</cvename> + <freebsdsa>FreeBSD-SA-16:01.sctp</freebsdsa> + </references> + <dates> + <discovery>2016-01-14</discovery> + <entry>2016-08-11</entry> + </dates> + </vuln> + <vuln vid="0e5d6969-600a-11e6-a6c3-14dae9d210b8"> <topic>FreeBSD -- rpcbind(8) remote denial of service [REVISED]</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201608112134.u7BLY0RB095413>