Vulnerability Note VU#905344

HTTP CONNECT and 407 Proxy Authentication Required messages are not integrity protected

Original Release date: 15 Aug 2016 | Last revised: 15 Aug 2016

Print Document

Tweet

Like Me

Share

Overview

HTTP CONNECT requests and 407 Proxy Authentication Required messages are not integrity protected and are susceptible to man-in-the-middle attacks. WebKit-based applications are additionally vulnerable to arbitrary HTML markup and JavaScript execution in the context of the originally requested domain.

Description

Web browsers and operating systems making a HTTPS request via a proxy server are vulnerable to man-in-the-middle (MITM) attacks against HTTP CONNECT requests and proxy response messages. HTTP CONNECT requests are made in clear text over HTTP, meaning an attacker in the position to modify proxy traffic may force the use of 407 Proxy Authentication Required responses to phish for credentials. WebKit-based clients are vulnerable to additional vectors due to the fact that HTML markup and JavaScript are rendered by the client Document Object Model (DOM) in the context of the originally requested HTTPS domain. For more information, refer to the FalseCONNECT website.

Impact

An attacker in the position to control HTTP CONNECT requests and proxy responses can conduct MITM attacks, which may include credential phishing and, where vulnerable WebKit-based clients are involved, arbitrary HTML and JavaScript injection.

Solution

Apply an update Check with affected software vendors and apply an update, if available. Those unable or unwilling to apply an update should consider the following workarounds.

Avoid untrusted networks Avoid using proxy-configured clients while connected to untrusted networks, including public WiFi. Using a proxy-configured client on an untrusted network increases the chance of falling victim to a MITM attack. Disable proxy configuration settings If use of proxy auto-configuration (PAC) or web proxy auto-discovery (WPAD) is not required, consider disabling them.

Vendor Information (Learn More)

Vendor	Status	Date Notified	Date Updated
Apple	Affected	17 Jun 2016	11 Aug 2016
Microsoft Corporation	Affected	17 Jun 2016	11 Aug 2016
Opera	Affected	17 Jun 2016	11 Aug 2016
Oracle Corporation	Affected	17 Jun 2016	11 Aug 2016
Lenovo	Not Affected	17 Jun 2016	01 Aug 2016
Arista Networks, Inc.	Unknown	17 Jun 2016	17 Jun 2016
Belkin, Inc.	Unknown	28 Jul 2016	28 Jul 2016
CentOS	Unknown	17 Jun 2016	17 Jun 2016
Cisco	Unknown	28 Jul 2016	28 Jul 2016
CoreOS	Unknown	17 Jun 2016	17 Jun 2016
Debian GNU/Linux	Unknown	17 Jun 2016	17 Jun 2016
DesktopBSD	Unknown	17 Jun 2016	17 Jun 2016
DragonFly BSD Project	Unknown	17 Jun 2016	17 Jun 2016
EMC Corporation	Unknown	17 Jun 2016	17 Jun 2016
F5 Networks, Inc.	Unknown	17 Jun 2016	17 Jun 2016

If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group	Score	Vector
Base	4.3	AV:A/AC:M/Au:N/C:P/I:P/A:N
Temporal	3.4	E:POC/RL:OF/RC:C
Environmental	3.4	CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

• http://falseconnect.com
• https://tools.ietf.org/html/rfc7235#section-3.2

Credit

Thanks to Jerry Decime for reporting these vulnerabilities.

This document was written by Joel Land.

Other Information

• CVE IDs: Unknown
• Date Public: 15 Aug 2016
• Date First Published: 15 Aug 2016
• Date Last Updated: 15 Aug 2016
• Document Revision: 23

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

- wong chee tat :)

Vulnerability Summary for CVE-2016-5696

Vulnerability Summary for CVE-2016-5696

Original release date: 08/06/2016

Last revised: 08/10/2016

Source: US-CERT/NIST

Overview

net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack.

Impact

CVSS Severity (version 3.0):

CVSS v3 Base Score: 5.9 Medium

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Impact Score: 3.6

Exploitability Score: 2.2

CVSS Version 3 Metrics:

Attack Vector (AV): Network

Attack Complexity (AC): High

Privileges Required (PR): None

User Interaction (UI): None

Scope (S): Unchanged

Confidentiality (C): High

Integrity (I): None

Availability (A): None

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 MEDIUM

Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: http://www.prnewswire.com/news-releases/mitnick-attack-reappears-at-geekpwn-macau-contest-300270779.html

Type: Technical Description

Hyperlink: http://www.prnewswire.com/news-releases/mitnick-attack-reappears-at-geekpwn-macau-contest-300270779.html

External Source: MLIST

Name: [oss-security] 20160712 Re: CVE-2016-5389: linux kernel - challange ack information leak.

Type: Mailing List; Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2016/07/12/2

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=1354708

Type: Issue Tracking

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1354708

External Source: CONFIRM

Name: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758

Type: Issue Tracking; Patch

Hyperlink: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758

External Source: CONFIRM

Name: https://github.com/torvalds/linux/commit/75ff39ccc1bd5d3c455b6822ab09e533c551f758

Type: Issue Tracking; Patch

Hyperlink: https://github.com/torvalds/linux/commit/75ff39ccc1bd5d3c455b6822ab09e533c551f758

Vulnerable software and versions

+ Configuration 1
* OR
* cpe:/o:linux:linux_kernel:4.6.6 and previous versions

* Denotes Vulnerable Software
Changes related to vulnerability configurations

Technical Details

Vulnerability Type (View All)

• Information Leak / Disclosure (CWE-200)

CVE Standard Vulnerability Entry http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5696

- wong chee tat :)

Apache httpd 2.2 vulnerabilities - Fixed in Apache httpd 2.2.32-dev

Apache httpd 2.2 vulnerabilities

Fixed in Apache httpd 2.2.32-dev

n/a: HTTP_PROXY environment variable "httpoxy" mitigation CVE-2016-5387

HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to avoid colliding with this CGI namespace. A mitigation is provided for the httpd CGI environment to avoid populating the "HTTP_PROXY" variable from a "Proxy:" header, which has never been registered by IANA.

This workaround and patch are documented in the ASF Advisory at https://www.apache.org/security/asf-httpoxy-response.txt

Acknowledgements: We would like to thank Dominic Scheirlinck and Scott Geary of Vend for reporting and proposing a fix for this issue.

Reported to security team: 2nd July 2016 Issue public: 18th July 2016

Update Released: 18th July 2016

Affects: 2.2.31, 2.2.29, 2.2.27, 2.2.26, 2.2.25, 2.2.24, 2.2.23, 2.2.22, 2.2.21, 2.2.20, 2.2.19, 2.2.18, 2.2.17, 2.2.16, 2.2.15, 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0

- wong chee tat :)

National Cybercrime Action Plan to step up fight against online crime: Shanmugam

National Cybercrime Action Plan to step up fight against online crime: Shanmugam
By Kimberly Spykerman, News 5  Posted 20 Jul 2016 18:41 Updated 20 Jul 2016 22:57

SINGAPORE: Singapore will do more in the battle against online crime through a National Cybercrime Action Plan, Home Affairs Minister and Law Minister K Shanmugam announced on Wednesday (Jul 20).

Speaking at a conference, Mr Shanmugam pointed out that the plan signifies a fundamental relook at the way cybercrime is tackled, and recognised the sea change cybercrime will bring about in society.

"Cybercrime is seen, and rightly identified, as a growing threat. It doesn't recognise national boundaries. They hide behind, they are in the shadows, and they strike. And the scale and the speed with which they can strike is such that it can cause tremendous damage," he said.

Cybercrimes around the world have been increasing, he added.

Mr Shanmugam also pointed out that cyberspace is changing the complexion of crimes all over the world. In the UK, the number of crimes that involved a computer exceeded physical crimes in 2015. In the same year in Singapore, the number of cases under the Computer Misuse and Cybersecurity Act increased by more than 40 per cent compared to 2014.

FOUR KEY PRIORITIES FOR FOUR KEY PRINCIPLES

Singapore will do its part through its action plan that is underpinned by four key principles - prevention, a quick, strong response to incidents of cybercrime, effective laws and close partnerships.

These will translate to four key priorities in the action plan, said Mr Shanmugam.

The first priority is to educate and empower the public to stay safe in cyberspace.

Prevention is key, said Mr Shanmugam, citing the police’s efforts to educate the public through ads, Crimewatch broadcasts, social media and other outreach avenues.

There will also be a special focus on vulnerable groups like the elderly and children. In this area, the police will work with schools and NGOs to raise awareness among these groups.

The police will also transform its existing Scam Alert website into a one-stop self-help portal, where people can get information on the latest modus operandi of cybercriminals, hear from other people’s experiences and report cases.

Secondly, authorities will enhance capabilities to fight cybercrime.

Mr Shanmugam noted that a Cybercrime Command was established in December 2015. It will carry out tasks such as analysing new methods used by cybercriminals, which can then be used to shape crime prevention messages.

The Home Affairs Ministry will also expand the curriculum of the Cyber Security Lab - which is a hands-on training facility - to cover topics like cyber-security fundamentals, digital forensics and malware analysis.

Third, laws will be strengthened to respond to the transnational nature of cybercrimes and the evolving tactics of such criminals. He added that existing laws will be looked at, to ensure they remain relevant even as traditional crimes shift online.

"What happens in the real world will have to be replicated in the virtual world. And we have to develop the tools to make sure they're updated for that," said Mr Shanmugam.

Lastly, local and international partnerships will be established.

Singapore has worked with the Chinese authorities to bust a spate of credit-for-sex scams and plans to support fellow ASEAN member states in developing cybercrime capabilities. An Institute of Safety and Security Studies - where ASEAN member states can also get training - has been established here.

Singapore is also home to Interpol's Global Complex for Innovation, which has a strong focus on cybercrime.

Mr Shanmugam emphasised that the Government will work closely with partners across all sectors to share knowledge and expertise, as well as to build capability.

Singapore, he added, is committed to supporting the global fight against cybercrime, and can contribute in the area of capability development - both regionally and internationally.

"COORDINATED APPROACH IS KEY"

Separately, Interpol chief Jurgen Stock said Singapore - as a hyper-connected, well-developed country - provides opportunities for cybercriminals. He added that mobile devices are set to become bigger targets, with more people using them to carry out important tasks such as banking transactions.

Mr Stock, who is the secretary-general of Interpol, said that is why having a coordinated approach is key to deterring cybercriminals.

"I think Singapore, with a new plan, provides a lot of measures to protect the system," he said. "And this is so important, and we have to understand that we have to build strong partnerships."

"The public has to play its role in protecting their own systems. So we all have to be aware of the way we use our smartphones, the way we use our computers. And we have to protect our critical infrastructure and our societies, and that is a huge task also for the lawmakers," he added.

- CNA/dl


- wong chee tat :)

Notice of security breach on Ubuntu Forums

Notice of security breach on Ubuntu Forums
By Jane Silber on 15 July 2016

There has been a security breach on the Ubuntu Forums site. We take information security and user privacy very seriously, follow a strict set of security practices and this incident has triggered a thorough investigation. Corrective action has been taken, and full service of the Forums has been restored.  In the interest of transparency, we’d like to share the details of the breach and what steps have been taken.  We apologise for the breach and ensuing inconvenience.

What happened

At 20:33 UTC on 14th July 2016, Canonical’s IS team were notified by a member of the Ubuntu Forums Council that someone was claiming to have a copy of the Forums database.

After some initial investigation, we were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure.  Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched.

What the attacker could access

The attacker had the ability to inject certain formatted SQL to the Forums database on the Forums database servers. This gave them the ability to read from any table but we believe they only ever read from the ‘user’ table.

They used this access to download portions of the ‘user’ table which contained usernames, email addresses and IPs for 2 million users. No active passwords were accessed; the passwords stored in this table were random strings as the Ubuntu Forums rely on Ubuntu Single Sign On for logins. The attacker did download these random strings (which were hashed and salted).

What the attacker could not access

We know the attacker was NOT able to gain access to any Ubuntu code repository or update mechanism.

We know the attacker was NOT able to gain access to valid user passwords.

We believe the attacker was NOT able to escalate past remote SQL read access to the Forums database on the Forums database servers.

We believe the attacker was NOT able to gain remote SQL write access to the Forums database.

We believe the attacker was NOT able to gain shell access on any of the Forums app or database servers.

We believe the attacker did NOT gain any access at all to the Forums front end servers.

We believe the attacker was NOT able to gain any access to any other Canonical or Ubuntu services.

What we’ve done

Cleanup

We backed up the servers running vBulletin, and then wiped them clean and rebuilt them from the ground up.
We brought vBulletin up to the latest patch level.
We reset all system and database passwords.
Hardening

We’ve installed ModSecurity, a Web Application Firewall, to help prevent similar attacks in the future.
We’ve improved our monitoring of vBulletin to ensure that security patches are applied promptly.





- wong chee tat :)

Security update available for Adobe XMP Toolkit for Java - July 2016

Adobe Security Bulletin

Security update available for Adobe XMP Toolkit for Java

Release date: July 12, 2016

Vulnerability identifier: APSB16-24

Priority: 3

CVE number: CVE-2016-4216

Platform: All

Summary

Adobe has released a security update for the Adobe XMP Toolkit for Java. This update resolves an important vulnerability that could lead to information disclosure (CVE-2016-4216). Adobe recommends users update their product installation using the instructions provided in the “Solution” Section below.

Affected software versions

Product	Affected Version	Platform
Adobe XMP Tooklit for Java	5.1.2 and earlier versions	All

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version by following the instructions below:

Product	Updated version	Platform	Priority rating	Availability
Adobe XMP Toolkit for Java	5.1.3	All	3	Download page

Adobe XMP toolkit for Java users can download the updated version via the following download page:http://www.adobe.com/devnet/xmp.html.  Adobe expects the updated version to be available during the week of July 11, 2016. 

Vulnerability Details

This update resolves an issue associated with the parsing of crafted XML external entities in XMPCore that could lead to information disclosure (CVE-2016-4216).

Acknowledgments

Adobe would like to thank Tim Allison of the MITRE corporation for reporting this issue (CVE-2016-4216) and for working with Adobe to help protect our customers.

- wong chee tat :)

Patch Tuesday - July 2016

Webpages, Word files, print servers menacing Windows PCs, and disk encryption bypasses – yup, it's Patch Tuesday

Plus: 52 security bugs fixed in Adobe Flash

19

36

12 Jul 2016 at 20:53, Shaun Nichols

Microsoft will fix critical holes in Internet Explorer, Edge, Office and Windows with this month's Patch Tuesday security bundle. Meanwhile, Adobe has patched dozens of exploitable vulnerabilities in its Flash player.
Redmond's July release includes 11 sets of patches, six rated as "critical" and five classified as "important." The highlights are: a BitLocker device encryption bypass, evil print servers executing code on vulnerable machines, booby-trapped webpages and Office files injecting malware into PCs, and the usual clutch of privilege elevation flaws.
Get patching now before miscreants develop and distribute code exploiting the programming blunders. As far as we can tell, none of the bugs below are being exploited in the wild right now.

• MS16-084 is a cumulative fix for Internet Explorer that addresses 15 CVE-listed vulnerabilities, including five memory corruption bugs and four scripting engine memory corruption bugs that can be exploited to execute code remotely on vulnerable machines. In other words, opening up a booby-trapped website that exploits these flaws could lead to malware infecting your PC.
  "The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user," said Microsoft.
• MS16-085 is also a cumulative browser fix, this time for the new Edge browser. Among the 13 CVE-listed holes in Edge are five remote code execution flaws in the Chakra JavaScript engine. Also patched are three information disclosure flaws, three spoofing vulnerabilities, and two other memory corruption flaws. Again, a malicious webpage could use these security holes to infect PCs with software nasties.
• MS16-088 patches seven memory corruption vulnerabilities in Office. The flaws could allow remote code execution if opened as local documents or information disclosure if targeted at SharePoint or Office Web Apps server. Office for Mac users will receive an update as well. Basically, malicious software can be smuggled in Office documents and will infect computers when opened.
• MS16-094 remedies a security bypass flaw in Windows Secure Boot. An attacker with admin or physical access – such as a thief or someone who has seized your PC – can exploit the vulnerability to install a policy that bypasses BitLocker and disk encryption.
  "A security feature bypass vulnerability exists when Windows Secure Boot improperly applies an affected policy," Microsoft explained.
  "An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. In addition, an attacker could bypass the Secure Boot Integrity Validation for BitLocker and the Device Encryption security features.
  "To exploit the vulnerability, an attacker must either gain administrative privileges or physical access to a target device to install an affected policy. The security update addresses the vulnerability by blacklisting affected policies."
• MS16-093 is Microsoft's distribution of this month's Adobe Flash Player security fixes. In all, 24 CVE-listed flaws are addressed, including remote code execution vulnerabilities. Users running Windows 8.1 and later and Server 2012 will get this update automatically. Older versions will need to get the update from Adobe (more details below).
• MS16-086 covers a single remote code execution flaw in the JScript and VBScript engines for Windows Vista and Server 2008. Later versions are not affected. "The vulnerability could allow remote code execution if a user visits a specially crafted website," admitted Microsoft.
• MS16-090 addresses six elevation of privilege vulnerabilities in all supported versions of Windows and Windows Server. An attacker can run a specially crafted application that exploits the kernel-level flaws to increase their user permissions and take over the system.
• MS16-087 is an update for flaws in the print spooler component of Windows: a man-in-the-middle attacker on a network can execute code on a remote vulnerable machine, or elevate their privileges if already running code on a system. Essentially, a rogue printer server on a network can inject malware into connected PCs. All supported versions of Windows and Windows Server are vulnerable.
• "A remote code execution vulnerability exists when the Windows Print Spooler service does not properly validate print drivers while installing a printer from servers," Microsoft confessed. "An attacker who successfully exploited this vulnerability could use it to execute arbitrary code and take control of an affected system.
• "An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application."
• MS16-089 fixes a single information disclosure flaw triggered when the Windows 10 kernel improperly handles objects in memory.
• MS16-091 is a patch for an information disclosure flaw in the .NET Framework triggered by running an XML file on a web application. The bug is found in all supported versions of Windows and Windows Server.
• MS16-092 addresses two flaws in the Windows kernel, one that discloses information about the kernel and another bypassing security access checks. All supported versions of Windows and Windows Server should be updated.

Meanwhile, Adobe is applying a few more strips of duct tape to holes in the internet's screen door with the July Flash Player update.
Windows, OS X, Linux, and ChromeOS users should check to make sure they have the latest version of the software.
In total, this month's patch remedies 52 CVE-listed vulnerabilities. If targeted, 49 of those would allow remote code execution, while the other three would allow information disclosure and memory leaks.
Adobe has also released an update for Acrobat/Reader and XMP Toolkit for Java. ®

- wong chee tat :)