From security em unicamp.br Mon Feb 6 09:18:35 2023 From: security em unicamp.br (CSIRT Unicamp) Date: Mon, 6 Feb 2023 09:18:35 -0300 Subject: [SECURITY-L] =?utf-8?q?=5BRNP/CAIS_Alerta_=230093=5D_Vulnerabili?= =?utf-8?q?dade_na_valida=C3=A7=C3=A3o_de_dados_HTTP_no_Apache_Serv?= =?utf-8?q?er?= Message-ID: CAIS-Alerta [03/02/2023]: Vulnerabilidade na validação de dados HTTP no Apache Server Prezados(as), O CAIS alerta para uma recente vulnerabilidade no módulo mod_proxy_ajp do Apache HTTP Server que pode permitir um agente malicioso burlar controles de segurança podendo causar vazamento de informações e até mesmo o comprometimento total do sistema afetado. Até a última revisão deste alerta, não foram identificados códigos capazes de explorar esta vulnerabilidade. Descrição O que é o mod_proxy_ajp do Apache Server? É um módulo de proxy que permite o Apache atuar como um proxy reverso para aplicativos Java baseados em servidor, como o Tomcat. Ele permite que o Apache gerencie as requisições HTTP e as encaminhe para o aplicativo Java, retornando a resposta ao cliente. O protocolo AJP (Apache JServ Protocol) é usado para comunicação entre o Apache e o aplicativo Java. A vulnerabilidade de "HTTP request smuggling" no mod_proxy_ajp do Apache HTTP Server é uma falha de segurança que consiste na alteração do formato ou do conteúdo de uma requisição HTTP burlando as verificações de segurança realizadas pelo servidor ou pelos dispositivos intermediários de rede. Isso pode permitir que um agente malicioso explore a vulnerabilidade comprometendo as solicitações feitas para o servidor AJP (Apache JServ Protocol) para obter informações confidenciais, interromper serviços e até mesmo tomar controle do sistema alvo. Sistemas impactados Apache HTTP Server com módulo mod_proxy_ajp ativado Versões afetadas Apache HTTP Server com módulo mod_proxy_ajp ativado, versões inferiores à 2.4.55 Correções disponíveis Apache HTTP Server com módulo mod_proxy_ajp ativado, aplicar o fix da versão 2.4.55 Identificadores CVE (http://cve.mitre.org) CVE-2022-36760 Mais informações https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-36760 https://www.cve.org/CVERecord?id=CVE-2022-36760 https://nvd.nist.gov/vuln/detail/CVE-2022-36760 https://ubuntu.com/security/CVE-2022-36760 O CAIS recomenda que os administradores mantenham seus sistemas e aplicativos sempre atualizados, de acordo com as últimas versões e correções oferecidas pelos fabricantes. Os alertas do CAIS também podem ser acompanhados pelas redes sociais da RNP. Siga-nos!! Twitter: @RedeRNP Facebook: facebook.com/RedeNacionaldeEnsinoePesquisaRNP. ################################################################ # CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS) # # Rede Nacional de Ensino e Pesquisa (RNP) # # # # cais em cais.rnp.br https://cais.rnp.br/ # # Tel. 019-37873300 Fax. 01 === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Mon Feb 13 17:45:22 2023 From: security em unicamp.br (CSIRT Unicamp) Date: Mon, 13 Feb 2023 17:45:22 -0300 Subject: [SECURITY-L] [RNP/CAIS Alerta #0096] Vulnerabilidade de Type Confusion no OpenSSL In-Reply-To: <19943408.78418.1676313801800.JavaMail.zimbra@rnp.br> References: <19943408.78418.1676313801800.JavaMail.zimbra@rnp.br> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CAIS-Alerta [13/02/2023]: Vulnerabilidade de Type Confusion no OpenSSL Prezados(as), O CAIS alerta para uma recente vulnerabilidade classificada como alta pela OpenSSL que permite ao agente malicioso ler conteúdo arbitrário na memória e/ou executar ataque de negação de serviço. Até a última revisão deste alerta, não foram identificados códigos capazes de explorar esta vulnerabilidade. Descrição Foi identificada uma vulnerabilidade de Type Confusion na biblioteca OpenSSL.A falha está relacionada ao processamento de um endereço X.400 na extenção X.509 GeneralNames.Quando a flag X509_V_FLAG_CRL_CHECK está habilitada é permitido que o atacante passe apontadores arbitrários para a call memcmp. A exploração dessa vulnerabilidade depende da ativação da flag acima e muitas vezes também do agente malicioso fornecer tanto a cadeia de certificados quanto o CRL (Lista de Revogação de certificados), no entanto nenhum dos certificados necessita possuir uma assinatura válida. Caso o atacante controle apenas uma dessas entradas, a outra a entrada já deve conter um endereço X.400 como um ponto de distribuição CRL, porém essa condição de configuração é incomum. Sistemas impactados OpenSSL Versões afetadas OpenSSL nas versões 3.0, 1.1.1 e 1.0.2 Correções disponíveis OpenSSL 3.0 deve ser atualizado para OpenSSL 3.0.8 OpenSSL 1.1.1 deve ser atualizado para 1.1.1t OpenSSL 1.0.2 deve ser atualizado para 1.0.2zg Identificadores CVE (http://cve.mitre.org) CVE-2023-0286 Mais informações https://www.openssl.org/news/secadv/20230207.txt https://nvd.nist.gov/vuln/detail/CVE-2023-0286 https://access.redhat.com/security/cve/cve-2023-0286 O CAIS recomenda que os administradores mantenham seus sistemas e aplicativos sempre atualizados, de acordo com as últimas versões e correções oferecidas pelos fabricantes. Os alertas do CAIS também podem ser acompanhados pelas redes sociais da RNP. Siga-nos!! Twitter: @RedeRNP Facebook: facebook.com/RedeNacionaldeEnsinoePesquisaRNP. ################################################################ # CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS) # # Rede Nacional de Ensino e Pesquisa (RNP) # # # # cais em cais.rnp.br https://cais.rnp.br/ # # Tel. 019-37873300 Fax. 019-37873301 # # Chave PGP disponível https://www.rnp.br/cais/cais-pgp.key # ################################################################ -----BEGIN PGP SIGNATURE----- Version: OpenPGP.js v2.6.2 Comment: https://openpgpjs.org wsFcBAEBCAAQBQJj6oSuCRDU96v9U5pXgAAAUnAP+gMpZPS9EJADA1VkmqSz 4FLry7M8wvr6CXtamb+6cgCDgAgOuTD0Uc80LY8eZrB9CJrp2ztR0P4zU1Zl Z/z2rd74sjK3LVDcG/O8lu7mJ48dqqtsfM+Bzc3Tg/E/KHDTlgWLqRrS+B/e C33oSRvrFBPYj8HqXJv1TTjDVpWc8nKuxEssYZhGfO7S/52/eaZ+NY6FlMJT UMWOroV01FhKIDt+oMNPLu8/c1EK/7XtZlH8GXCKx9En3r3BU77l5i9CEV4Q p4Vz9TM/AmDGGnOKJuvjQfsd8kRXWT32u+zJSx3ooq5frLY0iIkx+/6bm/rF nLD0JvpuPK679jG2/V+MhKz+lsXecsLHCTdnAtgDnarajq4XrfZKK6hAnVDc Rdd/jRyv/l7C5sQ4X2sz7fEjgjcL65YLqtsd2cjNO04oFJLxjJVOueGUhwnT c7tltTLj0L6dmD1MHOW4gf7rslgcZ18iO+lP7V4EfxAOAhpFs4HkABbbaPWZ YwBAEobB73fDVYCKQJeCeR9jL1KLModldZ4NNDvhuPH3HrWlHQ6DfF6eeDSe U3GyPHZrZ8Y0pQ4bkuoX30lgxWdeobh6+7rTMlPpe7zxqXJZdKSllaiVhILw fYHgIdruGw2qWeEMudYPOSEC0JmzaO9tfIqx7NY2wrim1vnmicB7VCTl5zui vXvM =SHuR -----END PGP SIGNATURE----- _______________________________________________ RNP-Alerta rnp-alerta em listas.rnp.br https://listas.rnp.br/mailman/listinfo/rnp-alerta === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Fri Feb 17 10:19:05 2023 From: security em unicamp.br (CSIRT Unicamp) Date: Fri, 17 Feb 2023 10:19:05 -0300 Subject: [SECURITY-L] FreeBSD Security Advisory FreeBSD-SA-23:03.openssl In-Reply-To: <20230216182400.1DCF14628@freefall.freebsd.org> References: <20230216182400.1DCF14628@freefall.freebsd.org> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:03.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2023-02-16 Credits: See referenced OpenSSL advisory. Affects: All supported versions of FreeBSD. Corrected: 2023-02-07 22:38:40 UTC (stable/13, 13.1-STABLE) 2023-02-16 17:58:13 UTC (releng/13.1, 13.1-RELEASE-p7) 2023-02-07 23:09:41 UTC (stable/12, 12.4-STABLE) 2023-02-16 18:04:12 UTC (releng/12.4, 12.4-RELEASE-p2) 2023-02-16 18:03:37 UTC (releng/12.3, 12.3-RELEASE-p12) CVE Name: CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured Open Source toolkit for the Transport Layer Security (TLS) protocol. It is also a general-purpose cryptography library. II. Problem Description * X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. * Timing Oracle in RSA Decryption (CVE-2022-4304) A timing based side channel exists in the OpenSSL RSA Decryption implementation. * Use-after-free following BIO_new_NDEF (CVE-2023-0215) The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. * Double free after calling PEM_read_bio_ex (CVE-2022-4450) The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. III. Impact * X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. * Timing Oracle in RSA Decryption (CVE-2022-4304) A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. * Use-after-free following BIO_new_NDEF (CVE-2023-0215) A use-after-free will occur under certain conditions. This will most likely result in a crash. * Double free after calling PEM_read_bio_ex (CVE-2022-4450) A double free may occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64, i386, or (on FreeBSD 13 and later) arm64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-23:03/openssl.patch # fetch https://security.FreeBSD.org/patches/SA-23:03/openssl.patch.asc # gpg --verify openssl.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the library, or reboot the system. VI. Correction details This issue is corrected by the corresponding Git commit hash or Subversion revision number in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/13/ 0904c29a0a11 stable/13-n254398 releng/13.1/ e237b128e080 releng/13.1-n250181 stable/12/ r372906 releng/12.4/ r372939 releng/12.3/ r372936 - ------------------------------------------------------------------------- For FreeBSD 13 and later: Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD For FreeBSD 12 and earlier: Run the following command to see which files were modified by a particular revision, replacing NNNNNN with the revision number: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmPucZwACgkQbljekB8A Gu9HjQ//Re9YWzj2N2OaIbEljpogMIUxDzltPdCk+v6SODdiMh2ZesKojEHv9u3G 3pFkJxzvqPX1BID8S7arZHnHUTeDKGq+eJef+q6gVmSA7F92l9eAK9UhTgeV5CDT VzFijM225KzFWA6VeD5pUtnCxze+Cor1y/XHAFPU1Ld5O+Tiem+vpN3OQt/hRlxI 3YC2zOKbpZiXX0vAiSsJw4r31yLqbY97Lmu3ccEAnKSNagkuFzuXyCSHroOPrIuB zvNmFK6Brv6hnG+yucqdGi2g21oIW2i/UhObohCcxnUXBIa6xAbVVoiEy+fmutXx T0JAOR75GqMuBUv4B4OT32cVkhZZJqWzSmeDed28cr5J3fWov+z7iePTezcFVMKj gY3G5Awm41Qg6zjVqxZdj5n56yFSUgD63ZN0MKBPy8VDgSOv9vQzVR12/XyGOQrv LnMtwtiI1qAoLiHXBLhrUOqrYw/WABHGNJVIVer4dzZCXw3VUqqxluqsUw0r5h9A J9Ox1zcTV3N6wTHeVwUsScwjANg5dfQ2xnDZHWsPwPJuyCCiDXx8X7D13ACkHYVS 3MqvRC4+wZTNttp3jH1JINe0CE7Z/euLDtPUdM3/xD/+mtO9g9ADg+GHkF5Tief2 i+AAWY/igHC1jQiXvmdFHf3IddxLoyhJAL5MiPxyTwAErR/8Xwc= =G1z4 -----END PGP SIGNATURE----- === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Fri Feb 17 10:20:19 2023 From: security em unicamp.br (CSIRT Unicamp) Date: Fri, 17 Feb 2023 10:20:19 -0300 Subject: [SECURITY-L] FreeBSD Security Advisory FreeBSD-SA-23:02.openssh In-Reply-To: <20230216182355.CF25C44CE@freefall.freebsd.org> References: <20230216182355.CF25C44CE@freefall.freebsd.org> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:02.openssh Security Advisory The FreeBSD Project Topic: OpenSSH pre-authentication double free Category: contrib Module: openssh Announced: 2023-02-16 Credits: Mantas Mikulenas Affects: FreeBSD 12.4 Corrected: 2023-02-08 21:06:22 UTC (stable/13, 13.2-STABLE) 2023-02-08 21:07:30 UTC (stable/12, 12.4-STABLE) 2023-02-16 18:04:07 UTC (releng/12.4, 12.4-RELEASE-p2) CVE Name: CVE-2023-25136 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background OpenSSH is an implementation of the SSH protocol suite, providing an encrypted and authenticated transport for a variety of services, including remote shell access. II. Problem Description A flaw in the backwards-compatibility key exchange route allows a pointer to be freed twice. III. Impact A remote, unauthenticated attacker may be able to cause a denial of service, or possibly remote code execution. Note that FreeBSD 12.3 and FreeBSD 13.1 include older versions of OpenSSH, and are not affected. FreeBSD 13.2-BETA1 and later include the fix. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64, i386, or (on FreeBSD 13 and later) arm64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 12.4] # fetch https://security.FreeBSD.org/patches/SA-23:02/openssh.patch # fetch https://security.FreeBSD.org/patches/SA-23:02/openssh.patch.asc # gpg --verify openssh.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart the applicable daemons, or reboot the system. VI. Correction details This issue is corrected by the corresponding Git commit hash or Subversion revision number in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/13/ 296ec8eae0c8 stable/13-n260933 stable/12/ r372919 releng/12.4/ r372938 - ------------------------------------------------------------------------- For FreeBSD 13 and later: Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD For FreeBSD 12 and earlier: Run the following command to see which files were modified by a particular revision, replacing NNNNNN with the revision number: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmPucY4ACgkQbljekB8A Gu+iNA/+OSEEsiNqkwsODt83JcagAx2MmEyDOjj0sz5IHXpjSWB0kfM4HU7spG1p F94ELys9aMzedPtvHtt0xZGTb6mMmdo+xJyit8NJaEsTqfsx6qjaEwyieakJleLs HMWBpvf8Gd7WVek8uxSmw146LpvuIXMPvASJ2aW0x8KDcPMagmZjHenFtX73F3c7 Hkqn3dgwoQCtwGLNVliQukq7v0Vdhq8s0WbmYcZxqXkg8l8Kf8NusT2koDcQUWR+ PH7OAAwA4DLxvOrPnmni2rxdfDgbXmcwpr8tBvHliN/Sgw3zH0fLUr2sL6gi/ORX iUKZB+RaI8Edw+FZhycKRSFJbl29TpzCr8ucgyspNamsbuPHVwai0mGCZ4UuKSuo mfnEup9DGkBYWZNPMeq4t7BF7oytDZTIKxmHS89XGZR22NZe7UNeRwIkxct61H8Z HBObWH/i2pCSOrFghVW8xnqgYbIr/evb95otL0Drkl605oR34pIlcH/4dvfrxadz Ugn83baGssvqYVL41Uc73ofL6ESveRjyYKKwP0EWSHDqOgjFcybFtf5y4mZqZr3f sjusHcHhzcQ5Cn1XL7cHVyM0/6ErGUD36Suy6LoAwUwXvXgM1B1QOQeopMiGE4EF 40AmlMBHMmWrMKauhOrs5n4J2MRZIeJg0uTmg7QS7I2+BE56NN8= =IJSD -----END PGP SIGNATURE----- === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: