ZSH and lib32-openssl Updates for Arch Linux
Posted on: 04/16/2018 07:26 AM

The following updates has been released for Arch Linux:

ASA-201804-5: zsh: arbitrary code execution
ASA-201804-6: lib32-openssl: private key recovery

ASA-201804-5: zsh: arbitrary code execution

Arch Linux Security Advisory ASA-201804-5
=========================================

Severity: High
Date : 2018-04-11
CVE-ID : CVE-2018-1100
Package : zsh
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-669

Summary
=======

The package zsh before version 5.5-1 is vulnerable to arbitrary code
execution.

Resolution
==========

Upgrade to 5.5-1.

# pacman -Syu "zsh>=5.5-1"

The problem has been fixed upstream in version 5.5.

Workaround
==========

None.

Description
===========

A stack-based buffer overflow has been found in zsh <= 5.4.2, in the
checkmailpath() function, where unchecked strings from the MAILCHECK
variable are copied to a buffer. A local, unprivileged user can create
a specially crafted message file, which, if used to set a custom "you
have new mail" message, leads to code execution in the context of the
user who receives the message. If the user affected is privileged, this
leads to privilege escalation.

Impact
======

A local attacker might be able to execute arbitrary code in the context
of another user.

References
==========

https://www.zsh.org/mla/workers/2018/msg00411.html
https://sourceforge.net/p/zsh/code/ci/31f72205630687c1cef89347863aab355296a27f/
https://security.archlinux.org/CVE-2018-1100


ASA-201804-6: lib32-openssl: private key recovery

Arch Linux Security Advisory ASA-201804-6
=========================================

Severity: Medium
Date : 2018-04-15
CVE-ID : CVE-2017-3738
Package : lib32-openssl
Type : private key recovery
Remote : Yes
Link : https://security.archlinux.org/AVG-551

Summary
=======

The package lib32-openssl before version 1:1.1.0.h-1 is vulnerable to
private key recovery.

Resolution
==========

Upgrade to 1:1.1.0.h-1.

# pacman -Syu "lib32-openssl>=1:1.1.0.h-1"

The problem has been fixed upstream in version 1.1.0.h.

Workaround
==========

None.

Description
===========

There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. No EC algorithms
are affected. Analysis suggests that attacks against RSA and DSA as a
result of this defect would be very difficult to perform and are not
believed likely. Attacks against DH1024 are considered just feasible,
because most of the work necessary to deduce information about a
private key may be performed offline. The amount of resources required
for such an attack would be significant. However, for an attack on TLS
to be meaningful, the server would have to share the DH1024 private key
among multiple clients, which is no longer an option since
CVE-2016-0701.

Impact
======

A remote attacker might be able to recover a private key (in very
unlikely cases).

References
==========

https://www.openssl.org/news/vulnerabilities.html#2017-3738
https://www.openssl.org/news/secadv/20171207.txt
https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f07a6253
https://security.archlinux.org/CVE-2017-3738





Printed from Linux Compatible (https://www.linuxcompatible.org/news/story/zsh_and_lib32_openssl_updates_for_arch_linux.html)