Friday Squid Blogging: Kraken Pie

Pretty, but contains no actual squid ingredients. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Zoom Linux Client 2.0.106600.0904 Buffer Overflow Vulnerability

The binary /opt/zoom/ZoomLauncher is vulnerable to a buffer overflow because it concatenates a overly long user input to a stack variable without checking if the destination buffer is long enough to hold the data. The binary also has important security features like canary turned off. The client...

The vulnerability of the `load_elf_binary` function in the Linux operating system’s kernel allows a hacker to execute arbitrary code.

The vulnerability of the loadelfbinary function in the Linux operating system’s kernel arises from the improper allocation of the address range for the binary file PIE. This occurs when the CONFIGARCHBINFMTELFRANDOMIZEPIE configuration option is enabled, and the usual strategy for allocating...

[ASA-201710-16] go-pie: arbitrary command execution

Arch Linux Security Advisory ASA-201710-16 ========================================== Severity: High Date : 2017-10-12 CVE-ID : CVE-2017-15041 Package : go-pie Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-442 Summary ======= The package go-pie before...

Oracle Linux 6 : kernel (ELSA-2017-2863)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2863 advisory. - net l2cap: prevent stack overflow on incoming bluetooth packet Neil Horman 1490060 1490062 CVE-2017-1000251 - fs binfmtelf.c:loadelfbinary: return -EINVAL on...

CVE-2017-1000253

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 committed on April 14, 2015. This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 backported to Linux 3.10.7...

DEBIAN-CVE-2017-1000253

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 committed on April 14, 2015. This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 backported to Linux 3.10.7...

CVE-2017-1000253

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 committed on April 14, 2015. This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 backported to Linux 3.10.7...

CentOS 7 before 1708 PIE/stack corruption Vulnerability

Exploit for linux platform in category remote exploits Linux PIE/stack corruption CVE-2017-1000253 ======================================================================== Contents ======================================================================== Summary Analysis Exploitation Acknowledgmen...

CVE-2017-1000253

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 committed on April 14, 2015. This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 backported to Linux 3.10.7...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3626)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3626 advisory. 2.6.39-400.297.9 - fs/binfmtelf.c: fix bug in loading of PIE binaries Michael Davidson Orabug: 26870958 CVE-2017-1000253 Tenable has extracted the preceding...

Unbreakable Enterprise kernel security update

2.6.39-400.297.9 - fs/binfmtelf.c: fix bug in loading of PIE binaries Michael Davidson Orabug: 26870958 CVE-2017-1000253...

Linux Local Privilege Escalation Vulnerability

A Linux PIE/stack corruption vulnerability exists. Most notably, all versions of CentOS 7 before 1708 released on September 13, 2017, all versions of Red Hat Enterprise Linux 7 before 7.4 released on August 1, 2017, and all versions of CentOS 6 and Red Hat Enterprise Linux 6 are exploitable. Linu...

RHEL 6 : kernel (RHSA-2017:2798)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2798 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw was found in the way the Linux kernel...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 7.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

Linux Kernel 3.10.0-514.21.2.el7.x86_64 3.10.0-514.26.1.el7.x86_64 (CentOS 7) - SUID Position Independent Executable PIE Local Privilege Escalation

Linux Kernel 3.10.0-514.21.2.el7.x8664 3.10.0-514.26.1.el7.x8664 CentOS 7 - SUID Position Independent Executable PIE Local Privilege Escalation / CVE-2017-1000253.c - an exploit for CentOS-7 kernel versions 3.10.0-514.21.2.el7.x8664 and 3.10.0-514.26.1.el7.x8664 Copyright C 2017 Qualys, Inc. This...

kernel: Incorrectly mapped contents of PIE executable

The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected...