|
Security
ByNathan Willis
June 24, 2015
Tor developer Jacob Appelbaum evidently surprised many in the
software-security business recently when he announced
on Twitter that『using Gmail has been the best legal services
investment I've ever made.』 The issue, evidently, was a secret
US government request for Appelbaum's email data—one which
Google was equipped and willing to fight in court. Google's actions,
Appelbaum suggested, other email providers would likely have been unable or
unmotivated to take. The debate that followed Appelbaum's Twitter post
raises a number of questions about the relative merits of engineering
and legal talent when it comes to service providers.
Court orders
The case that brought Appelbaum's use of Gmail to the forefront is
a court order requested by the US Department of Justice (DOJ) that
told Google to hand over roughly one year's worth of Appelbaum's Gmail
records—specifically, the email addresses of
everyone with whom he had exchanged mail and the IP addresses he had
used to access his own mail. The order was issued in January 2011,
and pertained to the 2010 Wikileaks diplomatic-cable disclosure.
According to Ryan Gallagher in The
Intercept's write-up of the case, Google fought the court order on
both free-speech and unreasonable-search-and-seizure (i.e., the US
Constitution's First and
Fourth Amendment) grounds. It also attempted to notify Appelbaum that his
records had been requested, but was blocked from doing so by a gag
order. Interestingly enough, the DOJ argued that the gag order was
important to the case because Twitter had notified several targets of
similar secret court orders that their records had been requested
(Appelbaum among them), and it disliked the subsequent backlash.
The email metadata was evidently turned over in March 2011, and the
government finally agreed to unseal the court records in April 2015,
in partially redacted form. Google subsequently notified Appelbaum of
the order. In The Intercept's story, Appelbaum commented that the news
of the legal battle was neither shocking nor necessary to confirm what
many already suspected. He noted that, since he now lives in Germany,
any further pursuit of the investigation will be more difficult for
the US court system to conceal.
That is more or less a predictable response to such a
circumstance. Other whistleblowers and critics of US government
surveillance have clearly also been the targets of similar secret
court orders—as the 2013 Lavabit
shutdown indicates. But Appelbaum's comment calling Gmail a
"legal services investment" on June 18 sparked a lot of
questions. The conventional wisdom, after all, is that it is safer to
use one's own server or to sign up with privacy-centric email provider—which Gmail certainly is not,
given Google's dependence on user-tracking ad delivery as a revenue stream.
Appelbaum posted
a general response on June 22, saying:『A few people have asked
why I would use GMail; the purpose is simple: 0) free legal
service from Google 1) expose the processes and results!』 A
few minutes later, he added:
"For many years, I have used services specifically to trap the
US Govt into picking fights that will become public." He also noted
that he could not afford to hire Google's legal team, but that:
"They did this work for free. Now we all know."
Varying threats
Twitter, it must be said, is not the easiest platform on which to
follow a multi-threaded discussion such as the one that ensued on June
22. However, a few relevant points can be picked out from the
traffic. The central issue is that the threat of surveillance by the NSA or
any other attacker using technical means to intercept traffic is
decidedly different from the threat of court-ordered record seizure.
Programmers may naturally gravitate toward the technical challenges,
but they ignore the other side at their peril.
In reference to the use of Gmail, Twitter user "Austerity_Sucks" asked
Appelbaum『you don't recommend others use Gmail for any reason even if
similar to yours right?』 Appelbaum then answered
that "it depends. I generally think @riseupnet is the right
choice."
Riseup.net, for those unfamiliar, is a
donation-funded email (and other communication services) platform that
puts a strong emphasis on user privacy: deleting logs, removing IP
addresses from email, and so forth—even taking steps to
ensure that what records it does keep cannot be used to identify
individuals. On one occasion in 2012, a Riseup.net server was seized
by law enforcement. The disks were encrypted and the company was not forced to hand over decryption keys, so no data may have been recovered. In addition, Riseup.net
refused to put the machine back in service after it was returned, in case some backdoor had been installed.
The service is, thus, somewhat akin to that previously offered by
Lavabit. User "OaklandElle," however, called the
recommendation "terrible advice," commenting
that:『In terms of government surveillance, it's incredibly naive
to believe that the feds will only use legal means to obtain
information.』
But that was not really the issue that Appelbaum faced in the
Wikileaks court-order incident. That was a case where the main
problem was the secrecy of the government—preventing Google from
even notifying Appelbaum that he was the target of a court order.
Mass interception and analysis of Internet traffic by intelligence
services (or anyone else) is a technical, not a public-policy,
concern. As Appelbaum mentioned
elsewhere in the discussion,『different techniques for different
attackers. DoJ isn't NSA.』
OaklandElle and several other users contended that email is an
inherently insecure means of communication, regardless of whether
Riseup.net or any other project is the service provider. Appelbaum
concurred,
saying that『using email means you've already chosen the wrong
tool for a job that requires actual security.』 He also pointed
out that a number of US-based service providers had cooperated
with the NSA's PRISM
data-collection program.
To what degree any email provider based in the US has willingly
complied with PRISM is hard to say—specifically, whether or not
a company allows the NSA to access server logs directly. The
Electronic Frontier Foundation publishes a report
about service providers' cooperation with the authorities, although it
naturally relies on some second-hand information. Google, for
one, has said
that it fights requests for user data that it feels are overly broad,
that it will notify users when it has received a request for a user's
records, and that it does not participate in PRISM's bulk surveillance.
Such claims will understandably be met with skepticism by some
users, and they do not address the issue of NSA wire-tapping that
operates entirely off the official, public record. As the 2011 request for Appelbaum's records indicate, though,
Google does at least resist court orders on some occasions. So
requests that come through the court system may eventually be brought
to light, even if other, off-book NSA interception efforts remain
hidden.
Had
Appelbaum been using Microsoft's Outlook.com (which is suspected of
cooperating with PRISM) instead, it is possible that neither he nor
the Internet at large would ever have heard of the DOJ records
request. Had he run a private email server, he might have had a
system that could be more effectively hardened against technical
attacks, but when the DOJ court order was served (either to him or to
his hosting provider), he would not have
been able to challenge it. There is no substitute for taking one's
encryption and
online-privacy setup seriously, but in this case, at least, there may
also be value in working with a service that has plenty of lawyers on
staff.
Comments (9 posted)
Brief items
One of the biggest conceptual problems we have is that something is believed secure until demonstrated otherwise. We need to reverse that: everything should be believed insecure until demonstrated otherwise.
— Bruce
Schneier reacts to an unsurprising report
that drug pumps are vulnerable to attacks
In the proposed "Soviet" version of RTBF [right to be forgotten], complainants wouldn't even have to specify links of concern, just vague topic areas. And unlike in Europe, even public figures could demand that Google and other search engine results be whitewashed to remove unflattering or revealing references.
Meanwhile, word comes from France that they might want Google to individually track French users wherever they go in the world so that they can be specifically subjected to EU RTBF censorship anywhere and everywhere. "Liberty, Equality, Fraternity?" Hogwash.
If this wasn't obvious before, it should be obvious to everyone with half a brain by now -- the power to censor Google and other search engines placed into the hands of governments -- any governments regardless of political orientations -- is the freedom of speech destroying equivalent of handing nuclear weapons to terrorists.
Comments (9 posted)
New vulnerabilities
cacti: SQL injection
| Package(s): | cacti |
CVE #(s): | CVE-2015-4342
|
| Created: | June 24, 2015 |
Updated: | June 25, 2015 |
| Description: |
From the CVE entry:
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id. |
| Alerts: |
|
Comments (none posted)
cinder: file disclosure
| Package(s): | cinder |
CVE #(s): | CVE-2015-1851
|
| Created: | June 19, 2015 |
Updated: | August 6, 2015 |
| Description: |
From the cinder bug report:
Bastian Blank reported a vulnerability in Cinder and Nova. By creating a qcow2 image with an arbitrary backing file, an authenticated user may mislead Cinder upload-to-image action, resulting in disclosure of any file from the Cinder server. A similar vulnerability in Nova can also be used by an authenticated user to trick Nova during a snapshot upload, resulting in disclosure of any file for which the Nova process user has access to. All Cinder setups and all Nova setups with force_raw_image (which is set by default) are affected. |
| Alerts: |
|
Comments (none posted)
curl: information disclosure
| Package(s): | curl |
CVE #(s): | CVE-2015-3236
CVE-2015-3237
|
| Created: | June 23, 2015 |
Updated: | July 6, 2015 |
| Description: |
From the Arch Linux advisory:
- CVE-2015-3236 (lingering HTTP credentials in connection re-use):
libcurl can wrongly send HTTP credentials when re-using connections.
libcurl allows applications to set credentials for the upcoming transfer
with HTTP Basic authentication, like with CURLOPT_USERPWD for example.
Name and password. Just like all other libcurl options the credentials
are sticky and are kept associated with the "handle" until something is
made to change the situation.
Further, libcurl offers a curl_easy_reset() function that resets a
handle back to its pristine state in terms of all settable options. A
reset is of course also supposed to clear the credentials. A reset is
typically used to clear up the handle and prepare it for a new, possibly
unrelated, transfer.
Within such a handle, libcurl can also store a set of previous
connections in case a second transfer is requested to a host name for
which an existing connection is already kept alive.
With this flaw present, using the handle even after a reset would make
libcurl accidentally use those credentials in a subsequent request if
done to the same host name and connection as was previously accessed.
An example case would be first requesting a password protected resource
from one section of a web site, and then do a second request of a public
resource from a completely different part of the site without
authentication. This flaw would then inadvertently leak the credentials
in the second request.
- CVE-2015-3237 (SMB send off unrelated memory contents):
libcurl can get tricked by a malicious SMB server to send off data it
did not intend to.
In libcurl's state machine function handling the SMB protocol
(smb_request_state()), two length and offset values are extracted from
data that has arrived over the network, and those values are
subsequently used to figure out what data range to send back.
The values are used and trusted without boundary checks and are just
assumed to be valid. This allows carefully handcrafted packages to trick
libcurl into responding and sending off data that was not intended. Or
just crash if the values cause libcurl to access invalid memory. |
| Alerts: |
|
Comments (none posted)
drupal7: multiple vulnerabilities
| Package(s): | drupal7 |
CVE #(s): | CVE-2015-3231
CVE-2015-3232
CVE-2015-3233
CVE-2015-3234
|
| Created: | June 19, 2015 |
Updated: | July 3, 2015 |
| Description: |
From the Debian advisory:
CVE-2015-3231 - Incorrect cache handling made private content viewed by "user 1" exposed to other, non-privileged users.
CVE-2015-3232 - A flaw in the Field UI module made it possible for attackers to redirect users to malicious sites.
CVE-2015-3233 - Due to insufficient URL validation, the Overlay module could be used to redirect users to malicious sites.
CVE-2015-3234 - The OpenID module allowed an attacker to log in as other users, including administrators. |
| Alerts: |
|
Comments (none posted)
drupal7-views: access bypass
| Package(s): | drupal7-views |
CVE #(s): | |
| Created: | June 22, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Drupal advisory:
Due to an issue in the caching mechanism of Views it's possible that configured filters lose their effect.
This can lead to exposure of content that otherwise would be hidden from visitors.
This vulnerability is mitigated by the fact that it can't be exploited directly but occurs when certain prerequisites meet.
Systems that use in-memory cache backends like redis / memcache are more likely to be affected by this issue. This is due the common strategy used to free cache space if the configured memory limit of the cache is reached. |
| Alerts: |
|
Comments (none posted)
ffmpeg: denial-of-service
| Package(s): | ffmpeg |
CVE #(s): | CVE-2014-9318
|
| Created: | June 19, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Mageia advisory:
The raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.0.7 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via a crafted .cine file that triggers the avpicture_get_size function to return a negative frame size. |
| Alerts: |
|
Comments (none posted)
gnutls: denial of service
| Package(s): | gnutls |
CVE #(s): | CVE-2015-3308
|
| Created: | June 23, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Gentoo advisory:
A context-dependent attacker can cause a denial of service condition. |
| Alerts: |
|
Comments (none posted)
krb5: authentication bypass
| Package(s): | krb5 |
CVE #(s): | CVE-2015-2694
|
| Created: | June 22, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the CVE entry:
The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2015-1573
|
| Created: | June 23, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Red Hat advisory:
A flaw was found in the way the nft_flush_table() function of the Linux
kernel's netfilter tables implementation flushed rules that were
referencing deleted chains. A local user who has the CAP_NET_ADMIN
capability could use this flaw to crash the system. |
| Alerts: |
|
Comments (none posted)
libclamunrar: double-free error
| Package(s): | libclamunrar |
CVE #(s): | |
| Created: | June 22, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Debian LTS advisory:
This update corrects a double-free error that existed within the
"unrar_extract_next_prepare()" function (libclamunrar_iface/unrar_iface.c)
when parsing a RAR file. While no CVE was assigned, this issue does have
potential security implications. |
| Alerts: |
|
Comments (none posted)
libwmf: code execution
| Package(s): | libwmf |
CVE #(s): | CVE-2015-0848
CVE-2015-4588
|
| Created: | June 24, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Red Hat bugzilla:
A heap buffer overflow flaw was found in the way the libwmf library processed WMF files containing BMP images. A specially crafted WMF file could cause an application using libwmf to crash or, possibly, execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
patch: file overwrites
| Package(s): | patch |
CVE #(s): | CVE-2015-1396
|
| Created: | June 23, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Ubuntu advisory:
Jakub Wilk discovered the fix for CVE-2015-1196 was incomplete for GNU patch.
An attacker could specially craft a patch file that could overwrite arbitrary
files with the privileges of the user invoking the program. This issue only
affected Ubuntu 14.04 LTS and Ubuntu 14.10. |
| Alerts: |
|
Comments (none posted)
php: multiple vulnerabilities
| Package(s): | php |
CVE #(s): | CVE-2015-3307
CVE-2015-3411
CVE-2015-3412
CVE-2015-4147
CVE-2015-4598
CVE-2015-4599
CVE-2015-4600
CVE-2015-4601
CVE-2015-4602
CVE-2015-4603
CVE-2015-4604
CVE-2015-4605
|
| Created: | June 23, 2015 |
Updated: | June 25, 2015 |
| Description: |
From the CVE entries:
The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive. (CVE-2015-3307)
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue. (CVE-2015-4147)
From the Red Hat advisory:
It was found that certain PHP functions did not properly handle file names
containing a NULL character. A remote attacker could possibly use this flaw
to make a PHP script access unexpected files and bypass intended file
system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026,
CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)
Multiple flaws were discovered in the way PHP performed object
unserialization. Specially crafted input processed by the unserialize()
function could cause a PHP application to crash or, possibly, execute
arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273,
CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600,
CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)
Multiple flaws were found in PHP's File Information (fileinfo) extension.
A remote attacker could cause a PHP application to crash if it used
fileinfo to identify type of attacker supplied files. (CVE-2014-9652,
CVE-2015-4604, CVE-2015-4605) |
| Alerts: |
|
Comments (none posted)
postgresql: multiple vulnerabilities
| Package(s): | postgresql |
CVE #(s): | |
| Created: | June 22, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the PostgreSQL 9.4.4 release notes:
-
Fix possible failure to recover from an inconsistent database state (Robert Haas)
-
Fix rare failure to invalidate relation cache init file (Tom Lane)
-
Avoid deadlock between incoming sessions and CREATE/DROP DATABASE (Tom Lane)
-
Improve planner's cost estimates for semi-joins and anti-joins with inner indexscans (Tom Lane, Tomas Vondra)
|
| Alerts: |
|
Comments (none posted)
pyjwt: accepts arbitrary tokens
| Package(s): | pyjwt |
CVE #(s): | |
| Created: | June 22, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the Debian advisory:
Tim McLean discovered that pyjwt, a Python implementation of JSON Web
Token, would try to verify an HMAC signature using an RSA or ECDSA public
key as secret. This could allow remote attackers to trick applications
expecting tokens signed with asymmetric keys, into accepting arbitrary
tokens. For more information see:
https://auth0.com/blog/2015/03/31/critical-vulnerabilitie...
|
| Alerts: |
|
Comments (none posted)
python-urllib3: proper openssl support
| Package(s): | python-urllib3 |
CVE #(s): | |
| Created: | June 18, 2015 |
Updated: | June 24, 2015 |
| Description: |
Asspecified in the urllib3 documentation, patch in PyOpenSSL. |
| Alerts: |
|
Comments (none posted)
wireshark: denial of service
| Package(s): | wireshark |
CVE #(s): | CVE-2015-4651
CVE-2015-4652
|
| Created: | June 24, 2015 |
Updated: | July 9, 2015 |
| Description: |
From the Debian advisory:
Multiple vulnerabilities were discovered in the dissectors for WCCP
and GSM DTAP, which could result in denial of service. |
| Alerts: |
|
Comments (none posted)
XWayland: permission bypass
| Package(s): | XWayland |
CVE #(s): | CVE-2015-3164
|
| Created: | June 22, 2015 |
Updated: | August 24, 2015 |
| Description: |
From the openSUSE bug report:
Ray Strode, a developer at Red Hat, discovered an authentication setup
issue inside the XWayland compatibility server, used to host X11 clients
inside a Wayland compositor's session. XWayland is used by Weston and
Mutter / GNOME Shell's Wayland mode.
Due to an omission in authentication setup, the XWayland server would
start up in non-authenticating mode, meaning that any client with access
to the server's UNIX socket was able to connect to the server and use it
as a regular client. No Wayland compositor was known to start XWayland
with TCP access open, so remote exploitation is not considered possible.
On many systems, all local users would have full access to the XWayland
server, allowing untrusted users to capture contents of, and input
destined for, other X11 clients.
This permission bypass does not extend to native Wayland clients:
XWayland is not given access to the buffers of any Wayland clients in
the host session, nor is any input sent to XWayland unless an X11
client was active at that time.
The resolution was to restrict XWayland connections to the same UID as
the server itself, matching Wayland's default permissions. |
| Alerts: |
|
Comments (none posted)
zendframework: two vulnerabilities
| Package(s): | zendframework |
CVE #(s): | CVE-2012-6531
CVE-2012-6532
|
| Created: | June 22, 2015 |
Updated: | June 24, 2015 |
| Description: |
From the CVE entries:
(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363. (CVE-2012-6531)
(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. (CVE-2012-6532) |
| Alerts: |
| Debian-LTS |
DLA-251-1 |
zendframework |
2015-06-20 |
| Debian-LTS |
DLA-251-2 |
zendframework |
2015-06-23 |
|
Comments (none posted)
Page editor: Jake Edge
Next page:
Kernel development>>
|
|
