[Slackware security] vulnerabilities outstanding 20140101

j_v · 08-08-2015, 08:40 PM

Quote:

Originally Posted by drgibbon

For some reason that didn't work for me, I had to explicitly load the Firefox profile from the command line as above. I tested it by adding:

Code:

blacklist {HOME}/documents

to /etc/firejail/firefox.profile and it was only when supplying the profile to the firejail call that access to ~/documents was denied (by Ctrl-O and browsing to ~/documents in Firefox), but YMMV.

@drgibbon,
I think I see... I'm still learning my way around firejail. I didn't want to edit the global profiles just yet. After reading the manual pages some more, I created the $HOME/.config/firejail directory and copied the firefox.profile there. Then, to try to get a feel for what you are getting at, I added

Code:

blacklist ${HOME}/.config

I get some errors from pango about error loading config from ${HOME}/.config, and can't access ${HOME}/.config with firefox openfile. One issue that I will report to the SBo firejail maintainer is that there is a bug in the build: the sub programs (firemon,ftee,...) are hard coded at $prefix/lib/firejail/ but the SlackBuild moves it to $prefix/lib${LIBDIRSUFFIX}/firejail; breaks running all sub progs on 64 bit install, so --output logging didn't work until I edited the build script.

We might be advised to open another thread about this, if we're going to continue discussing this, so that we don't spam this thread. Unless some suggest to keep it here.

mancha · 08-13-2015, 11:29 PM

Update 20150814 UTC

GnuTLS

A flaw results in a ServerKeyExchange signature sent by the server not being verified to be in the acceptable client set of
algorithms. That has the effect of allowing MD5 signatures even though they're disabled by default. (GNUTLS-SA-2015-2)

A flaw when decoding crafted certificates with very long DistinguishedName (DN) entries leads to double free, which may
result to a denial of service. (GNUTLS-SA-2015-3)

Recommendation for Slackware-14.1: Upgrade to GnuTLS 3.1.28 (sig) after applying gnutls-3.1.28_GNUTLS-SA-2015-2.diff,
gnutls-3.1.28_GNUTLS-SA-2015-3.diff, and gnutls-3.1.28_handshake-reg.diff (a handshake regression fix). You can use
Slackware 14.1's build files after changing the Slackbuild slightly (see below).

Recommendation for Slackware-current: Upgrade to GnuTLS 3.3.17.1 (sig). Alternatively, one can upgrade to GnuTLS 3.4.4.1
(sig) though bear in mind moving to 3.4.x will require more work (upgrading and/or rebuilding dependencies and reverse
dependencies).

Code:

--- gnutls.SlackBuild.pat
+++ gnutls.SlackBuild.mancha
@@ -22,8 +22,8 @@
 
 
 PKGNAM=gnutls
-VERSION=${VERSION:-$(echo gnutls-*.tar.?z* | rev | cut -f 4- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-1_slack14.1}
+VERSION=3.1.28
+BUILD=${BUILD:-1_mancha}
 
 # Automatically determine the architecture we're building on:
 if [ -z "$ARCH" ]; then
@@ -81,6 +81,18 @@
   \( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
   -exec chmod 644 {} \;
 
+# Fix security issues
+patch -p1 --verbose < $CWD/gnutls-3.1.28_GNUTLS-SA-2015-2.diff || exit 1
+patch -p1 --verbose < $CWD/gnutls-3.1.28_GNUTLS-SA-2015-3.diff || exit 1
+
+# Fix handshake regression introduced in 3.1.27
+patch -p1 --verbose < $CWD/gnutls-3.1.28_handshake-reg.diff || exit 1
+
+# Fix libopts snafu
+( cd src || exit 1
+  sed -i -e 's|#define AO_TEMPLATE_VERSION 167936|#define AO_TEMPLATE_VERSION 163842|' certtool-args.h.bak cli-args.h.bak cli-debug-args.h.bak danetool-args.h.bak ocsptool-args.h.bak p11tool-args.h.bak psk-args.h.bak serv-args.h.bak srptool-args.h.bak tpmtool-args.h.bak
+)
+
 CFLAGS="$SLKCFLAGS" \
 CXXFLAGS="$SLKCFLAGS" \
 ./configure \

--mancha

P.S. On another note...

Quote:

Originally Posted by cwizardone

Mancha, Where does that leave users of SeaMonkey, which hasn't been updated since March? Thanks

Hi cwizardone. I'm afraid I have some bad news. SeaMonkey has several outstanding vulnerabilities and all trees are closed due
to bug #1114876. I don't recommend its usage until that's resolved.

1337_powerslacker · 08-14-2015, 06:54 AM

mancha -

I tried upgrading to gnutls-3.4.4, and got the following compilation error:

Code:

In file included from srptool-args.c:43:0:
srptool-args.h:61:3: error: #error option template version mismatches autoopts/options.h header
 # error option template version mismatches autoopts/options.h header
   ^
srptool-args.h:62:3: error: unknown type name 'Choke'
   Choke Me.
   ^
srptool-args.h:62:11: error: expected '=', ',', ';', 'asm' or '__attribute__' before '.' token
   Choke Me.
           ^
srptool-args.h:80:3: warning: data definition has no type or storage class
 } teOptIndex;
   ^
srptool-args.h:80:3: warning: type defaults to 'int' in declaration of 'teOptIndex' [-Wimplicit-int]
srptool-args.c:369:29: error: 'INDEX_OPT_VERSION' undeclared here (not in a function)
   {  /* entry idx, value */ INDEX_OPT_VERSION, VALUE_OPT_VERSION,
                             ^
srptool-args.c:383:29: error: 'INDEX_OPT_HELP' undeclared here (not in a function)
   {  /* entry idx, value */ INDEX_OPT_HELP, VALUE_OPT_HELP,
                             ^
srptool-args.c:395:29: error: 'INDEX_OPT_MORE_HELP' undeclared here (not in a function)
   {  /* entry idx, value */ INDEX_OPT_MORE_HELP, VALUE_OPT_MORE_HELP,
                             ^
srptool-args.c: In function 'doOptDebug':
srptool-args.c:495:1: warning: implicit declaration of function 'VOIDP' [-Wimplicit-function-declaration]
 optionShowRange(pOptions, pOptDesc, VOIDP(rng), 1);
 ^
srptool-args.c:495:1: warning: nested extern declaration of 'VOIDP' [-Wnested-externs]
srptool-args.c:495:37: warning: passing argument 3 of 'optionShowRange' makes pointer from integer without a cast
 optionShowRange(pOptions, pOptDesc, VOIDP(rng), 1);
                                     ^
In file included from srptool-args.h:49:0,
                 from srptool-args.c:43:
../src/libopts/autoopts/options.h:1225:13: note: expected 'void *' but argument is of type 'int'
 extern void optionShowRange(tOptions*, tOptDesc*, void *, int);
             ^
srptool-args.c: At top level:
srptool-args.c:429:41: warning: suggest parentheses around arithmetic in operand of '|' [-Wparentheses]
 # define OPTPROC_BASE OPTPROC_TRANSLATE | OPTPROC_NXLAT_OPT
                                         ^
srptool-args.c:536:7: note: in expansion of macro 'OPTPROC_BASE'
     ( OPTPROC_BASE
       ^
srptool-args.c: In function 'AO_gettext':
srptool-args.c:610:19: warning: cast from function call of type 'int' to non-matching type 'char *' [-Wbad-function-cast]
             res = (char *)VOIDP(_(pz));
                   ^
srptool-args.c:612:15: warning: cast from function call of type 'int' to non-matching type 'char *' [-Wbad-function-cast]
         res = (char *)VOIDP(_(pz));
               ^
srptool-args.c: In function 'translate_option_strings':
srptool-args.c:651:23: warning: cast from function call of type 'int' to non-matching type 'char **' [-Wbad-function-cast]
         char ** ppz = (char**)VOIDP(&(option_xlateable_txt));
                       ^
srptool-args.c:661:19: warning: passing argument 1 of 'coerce_it' makes pointer from integer without a cast
         coerce_it(VOIDP(&(opts->pzCopyright)));
                   ^
srptool-args.c:630:13: note: expected 'void **' but argument is of type 'int'
 static void coerce_it(void ** s) { *s = AO_gettext(*s);
             ^
srptool-args.c:662:19: warning: passing argument 1 of 'coerce_it' makes pointer from integer without a cast
         coerce_it(VOIDP(&(opts->pzCopyNotice)));
                   ^
srptool-args.c:630:13: note: expected 'void **' but argument is of type 'int'
 static void coerce_it(void ** s) { *s = AO_gettext(*s);
             ^
srptool-args.c:663:19: warning: passing argument 1 of 'coerce_it' makes pointer from integer without a cast
         coerce_it(VOIDP(&(opts->pzFullVersion)));
                   ^
srptool-args.c:630:13: note: expected 'void **' but argument is of type 'int'
 static void coerce_it(void ** s) { *s = AO_gettext(*s);
             ^
srptool-args.c:664:19: warning: passing argument 1 of 'coerce_it' makes pointer from integer without a cast
         coerce_it(VOIDP(&(opts->pzUsageTitle)));
                   ^
srptool-args.c:630:13: note: expected 'void **' but argument is of type 'int'
 static void coerce_it(void ** s) { *s = AO_gettext(*s);
             ^
srptool-args.c:665:19: warning: passing argument 1 of 'coerce_it' makes pointer from integer without a cast
         coerce_it(VOIDP(&(opts->pzExplain)));
                   ^
srptool-args.c:630:13: note: expected 'void **' but argument is of type 'int'
 static void coerce_it(void ** s) { *s = AO_gettext(*s);
             ^
srptool-args.c:666:19: warning: passing argument 1 of 'coerce_it' makes pointer from integer without a cast
         coerce_it(VOIDP(&(opts->pzDetail)));
                   ^
srptool-args.c:630:13: note: expected 'void **' but argument is of type 'int'
 static void coerce_it(void ** s) { *s = AO_gettext(*s);
             ^
srptool-args.c:670:27: warning: passing argument 1 of 'coerce_it' makes pointer from integer without a cast
                 coerce_it(VOIDP(&(od->pzText)));
                           ^
srptool-args.c:630:13: note: expected 'void **' but argument is of type 'int'
 static void coerce_it(void ** s) { *s = AO_gettext(*s);
             ^
srptool-args.c: At top level:
srptool-args.c:42:0: warning: macro "OPTION_CODE_COMPILE" is not used [-Wunused-macros]
 #define OPTION_CODE_COMPILE 1
 ^

I used Slackware64-current's SlackBuild, but apparently something has changed so that it will not compile. What do you suggest?

mancha · 08-14-2015, 07:19 AM

Quote:

Originally Posted by mattallmill

mancha -

I tried upgrading to gnutls-3.4.4, and got the following compilation error:

I used Slackware64-current's SlackBuild, but apparently something has changed so that it will not compile. What do you suggest?

Hi mattallmill. Please use GnuTLS 3.4.4.1 instead. I've recently changed my recommendation in post #437 (find links there).

Alternatively, you can upgrade to GnuTLS 3.3.17.1 (sig) if you prefer that branch. Both should compile fine.

--mancha

1337_powerslacker · 08-14-2015, 08:00 AM

Quote:

Originally Posted by mancha

Hi mattallmill. Please use GnuTLS 3.4.4.1 instead. I've recently changed my recommendation in post #437 (find links there).

Alternatively, you can upgrade to GnuTLS 3.3.17.1 (sig) if you prefer that branch. Both should compile fine.

--mancha

Hey mancha -

Thanks for the updated recommendation. Yes, the .1 version successfully compiled.

Regards,

Matt

mancha · 08-14-2015, 08:07 AM

Update 20150814-1 UTC

Mozilla Firefox

Mozilla recently released Firefox ESR 38.2 that addresses multiple critical vulnerabilities (CVE-2015-4473, CVE-2015-4474,
CVE-2015-4479, CVE-2015-4480, CVE-2015-4485, CVE-2015-4486, CVE-2015-4493). Additionally, several vulnerabilities rated
high and one rated moderate were fixed.

Recommendation: Slackware 14.1 should upgrade to Firefox ESR 38.2.

Note: Slackware-current is current at Firefox 40.0 (technically, the latest is 40.0.2 but that's only relevant for Windows).

--mancha

1337_powerslacker · 08-14-2015, 08:31 AM

For anyone else following this thread:

Please NOTE that to upgrade gnutls:

a) There are two dependency packages which will also need to be upgraded to their latest versions: nettle, which is at 3.1.1, and gmp, which nettle depends on, is at 6.0.0 (rename source package to match version number, as the untarred version does *not* have 6.0.0a as the directory name).

a1) Upgrade gmp first, then nettle, then gnutls

b) All three packages (gnutls, nettle, gmp) have -compat32 counterparts, so don't forget to compile those versions as well (if you have multilib on your system, that is).

P.S. mancha, didn't mean to hijack your thread, just wanted to spare users some headaches (the upgrade made for an interesting morning to be sure!)

mancha · 08-14-2015, 09:04 AM

Quote:

Originally Posted by mattallmill

P.S. mancha, didn't mean to hijack your thread, just wanted to spare users some headaches (the upgrade made for an interesting morning to be sure!)

Hi mattallmill.

Thanks for the additional details.

I should clarify my approach a bit. My primary focus is providing recommendations for the latest stable release (currently Slackware
14.1). Those recommendations are designed to be self-contained and easy-to-follow for most users as long as they're comfortable
patching/building software.

I've also chosen to provide recommendations for Slackware's development tree (Slackware-current) for the benefit of PV and advanced
users. Those recommendations assume more technical knowledge and therefore might be a bit less detailed.

--mancha

1337_powerslacker · 08-14-2015, 12:07 PM

Quote:

Originally Posted by mancha

Hi mattallmill.

Thanks for the additional details.

I should clarify my approach a bit. My primary focus is providing recommendations for the latest stable release (currently Slackware
14.1). Those recommendations are designed to be self-contained and easy-to-follow for most users as long as they're comfortable
patching/building software.

I've also chosen to provide recommendations for Slackware's development tree (Slackware-current) for the benefit of PV and advanced
users. Those recommendations assume more technical knowledge and therefore might be a bit less detailed.

--mancha

Thanks for the clarification. I didn't know the process.

mralk3 · 08-14-2015, 01:20 PM

Earlier in this thread there was a script quoted that finds programs that are dependent on a specified library. I do not know how accurate it is, but I have used it a number of times with success. For gnutls, this script spits out a long list of binaries that are dependent on gnutls. So I can only assume that building a new version of gnutls requires quite a bit of work when you take into consideration all dependencies.

Here is the script I use:

Code:

#!/bin/sh

if [ "$1" == "" ]; 
then
    echo "Supply a library name please!"
    exit 0
fi

for dir in /bin /sbin /usr/bin /usr/sbin; do
    find "$dir" -type f -exec sh -c "file '{}' | (grep ELF >/dev/null &&
        (ldd '{}' | (grep $1 >/dev/null && echo '{}')))" \;
done

mats_b_tegner · 08-15-2015, 01:53 AM

Quote:

Originally Posted by mancha

Update 20150814-1 UTC

Mozilla Firefox

Mozilla recently released Firefox ESR 38.2 that addresses multiple critical vulnerabilities (CVE-2015-4473, CVE-2015-4474,
CVE-2015-4479, CVE-2015-4480, CVE-2015-4485, CVE-2015-4486, CVE-2015-4493). Additionally, several vulnerabilities rated
high and one rated moderate were fixed.

Recommendation: Slackware 14.1 should upgrade to Firefox ESR 38.2.

Note: Slackware-current is current at Firefox 40.0 (technically, the latest is 40.0.2 but that's only relevant for Windows).

--mancha

Firefox is updated for Slackware 14.1 according to the latest ChangeLog.

cwizardone · 08-17-2015, 09:15 AM

Quote:

Originally Posted by mancha

Update 20150814 UTC

P.S. On another note...

Hi cwizardone. I'm afraid I have some bad news. SeaMonkey has several outstanding vulnerabilities and all trees are closed due
to bug #1114876. I don't recommend its usage until that's resolved.

Mancha,
Thanks for the heads up!
Your work is greatly appreciated!

mancha · 08-28-2015, 12:16 AM

Update 20150828 UTC

Mozilla Firefox

Mozilla has addressed a couple of critical-impact vulnerabilities (including one that can result in remote code execution) and
one high-impact vulnerability in Firefox.

Recommendation: Upgrade to Firefox ESR 38.2.1 or Firefox 40.0.3, asap.

--mancha

mats_b_tegner · 08-30-2015, 03:31 AM

Firefox was updated yesterday according to the latest ChangeLog.

mats_b_tegner · 09-01-2015, 07:52 AM

libvdpau has been updated to version 1.1.1 which fixes three CVEs:
http://lists.x.org/archives/xorg-ann...st/002630.html