Vulnerability Roundup 14 #21289

grahamc · 2016-12-19T22:05:31Z

Here are all the vulnerabilities from https://lwn.net/Vulnerabilities
since our last roundup

This roundup is different from previous' due to Christmas: http://lists.science.uu.nl/pipermail/nix-dev/2016-December/022367.html

I will update this issue tomorrow and Wednesday with new issues.

cc: @NeQuissimus @bachp @domenkozar @makefu.

Note: The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.
If you would like to be CC'd on all roundups, leave a comment and
tell @grahamc so.

Permanent CC's: @joepie91, @phanimahesh, @NixOS/security-notifications
(if you no longer want to be CC'd, ask to be removed from this list)

Notes on the list

The reports have been roughly grouped by the package name. This
isn't perfect, but is intended to help identify if a whole group
of reports is resolved already.
Some issues will be duplicated, because it affects multiple
packages. For example, there are sometimes problems that impact
thunderbird, and firefox. LWN might report in one vulnerability
"thunderbird firefox". These names have been split to make sure
both packages get addressed.
By each issue is a link to code search for the package name, and
a Github search by filename. These are to help, but may not return
results when we do in fact package the software. If a search
doesn't turn up, please try altering the search criteria or
looking in nixpkgs manually before asserting we don't have it.
This issue is created by https://github.com/NixOS/security

Instructions:

Triage a report: If we don't have the software or our version isn't
vulnerable, tick the box or add a comment with the report number,
stating it isn't vulnerable.
Fix the issue: If we do have the software and it is vulnerable,
either leave a comment on this issue saying so, even open a pull
request with the fix. If you open a PR, make sure to tag this
issue so we can coordinate.
When an entire section is completed, move the section to the
"Triaged and Resolved Issues" details block below.

Upon Completion ...

Run the issue through reformat one last time
Review commits since last roundup for backport candidates
Send an update e-mail to nix-security-announce@googlegroups.com
Update the database at https://github.com/NixOS/security

Without further ado...

Assorted (18 issues)

firefox (3 issues)

#709468 (search, files) firefox: denial of service
#709140 (search, files) mozilla: multiple vulnerabilities
#709141 (search, files) mozilla: multiple vulnerabilities

game-music-emu (2 issues)

#709663 (search, files) game-music-emu: multiple vulnerabilities
#709341 (search, files) game-music-emu: code execution

kernel (2 issues)

#709853 (search, files) kernel: code execution
#709851 (search, files) kernel: two vulnerabilities

tomcat (2 issues)

#709662 (search, files) tomcat: two vulnerabilities
#709342 (search, files) tomcat: denial of service

xen (2 issues)

#709746 (search, files) xen: information leak
#709670 (search, files) xen: multiple vulnerabilities

The text was updated successfully, but these errors were encountered:

joachifm · 2016-12-20T00:08:33Z

A fix for #709669 was included in 4.8.14

phanimahesh · 2016-12-20T06:24:45Z

Commit 86cf682 fixes #709468 firefox: denial of service. Can be marked as done.

grahamc · 2016-12-20T13:15:21Z

libupnp is actually pupnp and can be found here: http://pupnp.sourceforge.net/ where it says 1.6.21 is out, but the downloads are all for 1.6.20. If anyone wants to investigate that, please!

grahamc · 2016-12-20T13:18:36Z

~~most needs updating to 5.0.0a and application of patches from debian, I think: https://security-tracker.debian.org/tracker/source-package/most~~

grahamc · 2016-12-20T13:25:52Z

Looks like Xen needs more patches. Also, our Xen is running out of time. @michalpalka -- you seem to open issues about Xen, would you like to try upgrading Xen?

michalpalka · 2016-12-20T13:30:32Z

@grahamc My schedule is full for the next 2 days, but will look at it on Friday

grahamc · 2016-12-20T13:31:22Z

That will be really helpful. Thank you so much, @michalpalka!

grahamc · 2016-12-20T13:31:25Z

We should quite likely drop samba3.

grahamc · 2016-12-20T13:40:35Z

../auth/kerberos/kerberos_pac.c: In function 'check_pac_checksum':
../auth/kerberos/kerberos_pac.c:46:7: error: 'CKSUMTYPE_HMAC_SHA1_96_AES_256' undeclared (first use in this function)
  case CKSUMTYPE_HMAC_SHA1_96_AES_256:
       ^
../auth/kerberos/kerberos_pac.c:46:7: note: each undeclared identifier is reported only once for each function it appears in
../auth/kerberos/kerberos_pac.c:52:7: error: 'CKSUMTYPE_HMAC_SHA1_96_AES_128' undeclared (first use in this function)
  case CKSUMTYPE_HMAC_SHA1_96_AES_128:
       ^
Waf: Leaving directory `/tmp/nix-build-samba-4.4.8.drv-0/samba-4.4.8/bin'
Build failed:  -> task failed (err #1): 
	{task: cc kerberos_pac.c -> kerberos_pac_1.o}
make: *** [Makefile:8: all] Error 1

@abbradar, @wkennington any ideas on what is wrong with samba here?

abbradar · 2016-12-20T14:10:30Z

@grahamc I've tried to update libkrb5 and Cyrus-SASL -- no luck so far. I'll spend more time on this later since this is a security issue but have no idea what happens. I left Samba 4.5.3 to build in the background but this is not an option for the release, isn't it?...

grahamc · 2016-12-20T14:12:43Z

Thank you for looking, @abbradar. Unfortunately backporting an update to 4.5.x wouldn't be good. I definitely wouldn't mind seeing unstable updated though, especially before 17.03 goes stable ( @michalpalka -- that is when I'd like Xen to be upgraded at the latest, hopefully)

abbradar · 2016-12-20T18:33:18Z

Samba, libkrb5 and Cyrus-SASL updates are in staging, because Cyrus-SASL is a systemd dependency. We now need to determine how to build new 4.4.* -- I'm on it but with no ideas currently.

bachp · 2016-12-20T18:57:11Z

I did some investigation on libupnp. There is a 1.6.21 tag available but no tarball.

grahamc · 2016-12-20T19:51:57Z

@abbradar can you link each of those commits here to make it easier to keep track / ensure they get backported?

abbradar · 2016-12-20T19:58:20Z

b0a1028 covers Samba in staging. Others don't have a security issue assigned IIUC. I want to avoid having it backported as is now -- instead I'll try to have a maintenance release building.

abbradar · 2016-12-20T20:33:52Z

16.09 is covered by b2e80a5

LnL7 · 2016-12-20T20:57:58Z

This might work for libupnp #21317.

grahamc · 2016-12-21T12:25:13Z

Just updated the list with more vulnerabilities.

grahamc · 2016-12-21T12:41:48Z

I suspect we need to apply patches to xen, see: https://xenbits.xen.org/xsa/advisory-200.html and: an enterprising contributor may go back through old advisories and see if we missed anything :)

grahamc · 2016-12-21T12:48:23Z

We don't run debian's version of most, so we don't need patches.

grahamc · 2016-12-21T14:08:12Z

I just push my roundup branch which contains fixes for everything but the html5lib, will merge shortly.

Switching to git tags means we don't get pre-generated configure scripts. Thusly, run bootstrap ourselves. For NixOS#21289 For CVE-2016-8863 (remote code execution)

Switching to git tags means we don't get pre-generated configure scripts. Thusly, run bootstrap ourselves. For #21289 For CVE-2016-8863 (remote code execution) (cherry picked from commit 0d3f0f0)

grahamc · 2016-12-21T21:20:26Z

Merged and backported the branch. Just updated this issue with new vulnerabilities. :)

(this issue is like the gift that keeps giving!)

grahamc · 2016-12-21T21:35:38Z

@the-kenny can you update flightgear?

grahamc · 2016-12-21T22:17:16Z

Just pushed patches for zlib to staging, will push to 16.09 shortly.

grahamc · 2016-12-21T22:19:47Z

@wkennington can you patch ceph? We're pretty old, I might mark it as broken otherwise.

bachp · 2016-12-21T22:46:11Z

@grahamc The libupnp tarball would be available now: https://sourceforge.net/projects/pupnp/files/

grahamc · 2016-12-21T22:48:14Z

Thank you, @bachp I already switched to their github mirror since it already had a good tag.

the-kenny · 2016-12-22T09:22:43Z

Graham Christensen <notifications@github.com> writes:

@the-kenny can you update flightgear?

will do!

phanimahesh · 2016-12-23T06:14:10Z

Sorry, I couldn't get around to finishing the html5lib update, got busy with work-related issues.
It requires a few dependencies (webencodings, and others I don't recollect) that have to be added to nixpkgs. My schedule for today and tomorrow is chaotic, not sure if I'll be able to clean it up. If anyone can, please comment on the issue and pitch in. I'll get to it as soon as I can make some time for it.

the-kenny · 2016-12-24T22:07:06Z

Sorry it took so long. Holidays. Just pushed bdc880e to master. I'm not sure if this should be backported to our current stable release as we skipped quite a few major releases. Any other comments on this? Cheers Moritz Moritz Ulrich <moritz@tarn-vedra.de> writes:

…

Graham Christensen ***@***.***> writes: > @the-kenny can you update flightgear? will do!

--

Mic92 · 2016-12-24T23:03:18Z

@the-kenny does neither not look like a critical network-facing service to me nor a serious security issue (I would not expect that malicious Nasal scripts are sent as email attachments any time soon). On the other hand it does not look the typical application, where people would expect the version to be stable all the time. I think both approaches (upgrading or not upgrading) are fine.

fixes LWN vuln:709146 ref #21289: Vulnerability roundup 14

grahamc · 2016-12-25T13:02:10Z

The PR from f3287b0 needs to be backported.

grahamc · 2016-12-25T13:05:12Z

Also, the html5lib changes would be good to backport.

@FRidh -- thank you for merging that!

@bjornfor -- I agree, I try really hard to test all my changes. Even still, a few mistakes come through. I always feel bad about it.

FRidh · 2016-12-25T13:07:14Z

@grahamc the new html5lib has quite some extra dependencies. I'll have a look at it.

bjornfor · 2016-12-25T14:09:50Z

@bjornfor -- I agree, I try really hard to test all my changes. Even still, a few mistakes come through. I always feel bad about it.

It's frustrating when breakage happens, but I do appreciate the work you and everyone else put into keeping NixOS updated and secure :-)

fixes LWN vuln:709146 ref #21289: Vulnerability roundup 14 (cherry picked from commit a737eff)

FRidh · 2016-12-25T15:20:39Z

We now have the latest html5lib in stable as well.

vcunat · 2016-12-25T21:17:37Z

It seems like openssh has fallen through the cracks. I didn't manage to fully fix it (yet) 661b5a9.

grahamc · 2016-12-25T21:24:53Z

@vcunat openssh hasn't fallen through the cracks, it hadn't been released yet when this was created. I just checked, it'll appear on next week's.

vcunat · 2016-12-25T21:42:22Z

Oh, now I see the tarball timestamp is Dec.19; I originally misread it as ~week earlier.

grahamc · 2016-12-26T16:47:35Z

I'm going to close out what we have and let the remainders come back next run.

grahamc · 2016-12-26T16:49:45Z

Good work, everyone - thank you all!

Switching to git tags means we don't get pre-generated configure scripts. Thusly, run bootstrap ourselves. For NixOS#21289 For CVE-2016-8863 (remote code execution) (cherry picked from commit 0d3f0f0)

fixes LWN vuln:709146 ref NixOS#21289: Vulnerability roundup 14 (cherry picked from commit a737eff)

grahamc added the 1.severity: security label Dec 19, 2016

phanimahesh mentioned this issue Dec 20, 2016

python:html5lib: 0.999 -> 0.999999999 #21299

Merged

7 tasks

grahamc mentioned this issue Dec 21, 2016

WIP: Roundup 14 #21335

Merged

7 tasks

FRidh pushed a commit that referenced this issue Dec 25, 2016

python:html5lib: 0.999 -> 0.999999999

a737eff

fixes LWN vuln:709146 ref #21289: Vulnerability roundup 14

FRidh pushed a commit that referenced this issue Dec 25, 2016

python:html5lib: 0.999 -> 0.999999999

a1f9b59

fixes LWN vuln:709146 ref #21289: Vulnerability roundup 14 (cherry picked from commit a737eff)

grahamc closed this as completed Dec 26, 2016

grahamc mentioned this issue Dec 28, 2016

Vulnerability Roundup 15 #21457

Closed

23 tasks

adrianpk added a commit to adrianpk/nixpkgs that referenced this issue May 31, 2024

python:html5lib: 0.999 -> 0.999999999

daacebf

fixes LWN vuln:709146 ref NixOS#21289: Vulnerability roundup 14 (cherry picked from commit a737eff)

Vulnerability Roundup 14 #21289

Vulnerability Roundup 14 #21289

Comments

grahamc commented Dec 19, 2016 • edited

Notes on the list

Instructions:

Upon Completion ...

Assorted (18 issues)

firefox (3 issues)

game-music-emu (2 issues)

kernel (2 issues)

tomcat (2 issues)

xen (2 issues)

joachifm commented Dec 20, 2016

phanimahesh commented Dec 20, 2016

grahamc commented Dec 20, 2016

grahamc commented Dec 20, 2016 • edited

grahamc commented Dec 20, 2016

michalpalka commented Dec 20, 2016

grahamc commented Dec 20, 2016

grahamc commented Dec 20, 2016

grahamc commented Dec 20, 2016

abbradar commented Dec 20, 2016

grahamc commented Dec 20, 2016

abbradar commented Dec 20, 2016

bachp commented Dec 20, 2016

grahamc commented Dec 20, 2016

abbradar commented Dec 20, 2016

abbradar commented Dec 20, 2016

LnL7 commented Dec 20, 2016

grahamc commented Dec 21, 2016

grahamc commented Dec 21, 2016

grahamc commented Dec 21, 2016

grahamc commented Dec 21, 2016

grahamc commented Dec 21, 2016 • edited

grahamc commented Dec 21, 2016

grahamc commented Dec 21, 2016

grahamc commented Dec 21, 2016

bachp commented Dec 21, 2016

grahamc commented Dec 21, 2016

the-kenny commented Dec 22, 2016 via email

phanimahesh commented Dec 23, 2016

the-kenny commented Dec 24, 2016 via email

Mic92 commented Dec 24, 2016

grahamc commented Dec 25, 2016

grahamc commented Dec 25, 2016

FRidh commented Dec 25, 2016

bjornfor commented Dec 25, 2016

FRidh commented Dec 25, 2016

vcunat commented Dec 25, 2016

grahamc commented Dec 25, 2016

vcunat commented Dec 25, 2016 • edited

grahamc commented Dec 26, 2016

grahamc commented Dec 26, 2016

grahamc commented Dec 19, 2016 •

edited

grahamc commented Dec 20, 2016 •

edited

grahamc commented Dec 21, 2016 •

edited

vcunat commented Dec 25, 2016 •

edited