Discover Government News

Arch Linux Security Advisory ASA-201705-18
=========================================
Severity: High
Date    : 2017-05-16
CVE-ID  : CVE-2017-5209 CVE-2017-5545 CVE-2017-5834 CVE-2017-5835
          CVE-2017-5836 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437
          CVE-2017-6438 CVE-2017-6439 CVE-2017-6440
Package : libplist
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-215

Summary
======
The package libplist before version 2.0.0-1 is vulnerable to multiple
issues including arbitrary command execution, denial of service and
information disclosure.

Resolution
=========
Upgrade to 2.0.0-1.

# pacman -Syu "libplist>=2.0.0-1"

The problems have been fixed upstream in version 2.0.0.

Workaround
=========
None.

Description
==========
- CVE-2017-5209 (information disclosure)

The base64decode function in base64.c in libimobiledevice libplist
through 1.12 allows attackers to obtain sensitive information from
process memory or cause a denial of service (buffer over-read) via
split encoded Apple Property List data.

- CVE-2017-5545 (denial of service)

The main function in plistutil.c in libimobiledevice libplist through
1.12 allows attackers to obtain sensitive information from process
memory or cause a denial of service (buffer over-read) via Apple
Property List data that is too short.

- CVE-2017-5834 (denial of service)

The parse_dict_node function in bplist.c in libplist allows attackersto cause a denial of service (out-of-bounds heap read and crash) via a
crafted file.

- CVE-2017-5835 (denial of service)

libplist allows attackers to cause a denial of service (large memory
allocation and crash) via vectors involving an offset size of zero.

- CVE-2017-5836 (denial of service)

The plist_free_data function in plist.c in libplist allows attackers to
cause a denial of service (crash) via vectors involving an integer node
that is treated as a PLIST_KEY and then triggers an invalid free.

- CVE-2017-6435 (denial of service)

The parse_string_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory
corruption) via a crafted plist file.

- CVE-2017-6436 (denial of service)

The parse_string_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory allocation
error) via a crafted plist file.

- CVE-2017-6437 (denial of service)

The base64encode function in base64.c in libimobiledevice libplist 1.12
allows local users to cause a denial of service (out-of-bounds read)
via a crafted plist file.

- CVE-2017-6438 (arbitrary command execution)

Heap-based buffer overflow in the parse_unicode_node function in
bplist.c in libimobiledevice libplist 1.12 allows local users to cause
a denial of service (out-of-bounds write) and possibly code execution
via a crafted plist file.

- CVE-2017-6439 (denial of service)

Heap-based buffer overflow in the parse_string_node function in
bplist.c in libimobiledevice libplist 1.12 allows local users to cause
a denial of service (out-of-bounds write) via a crafted plist file.

- CVE-2017-6440 (denial of service)

The parse_data_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory allocation
error) via a crafted plist file.

Impact
=====
An attacker is able to crash the process, read sensitive information or
execute arbitrary code on the host by providing a crafted plist file or
string.

References
=========
https://github.com/libimobiledevice/libplist/issues/93
https://github.com/libimobiledevice/libplist/issues/94
https://github.com/libimobiledevice/libplist/issues/95
https://github.com/libimobiledevice/libplist/issues/99
https://github.com/libimobiledevice/libplist/issues/98
https://github.com/libimobiledevice/libplist/issues/100
https://github.com/libimobiledevice/libplist/blob/master/NEWS
https://bugzilla.redhat.com/show_bug.cgi?id=1412613
https://bugzilla.redhat.com/show_bug.cgi?id=1416002
https://bugzilla.redhat.com/show_bug.cgi?id=1418591
https://bugzilla.redhat.com/show_bug.cgi?id=1418592
https://bugzilla.redhat.com/show_bug.cgi?id=1418593
https://security.archlinux.org/CVE-2017-5209
https://security.archlinux.org/CVE-2017-5545
https://security.archlinux.org/CVE-2017-5834
https://security.archlinux.org/CVE-2017-5835
https://security.archlinux.org/CVE-2017-5836
https://security.archlinux.org/CVE-2017-6435
https://security.archlinux.org/CVE-2017-6436
https://security.archlinux.org/CVE-2017-6437
https://security.archlinux.org/CVE-2017-6438
https://security.archlinux.org/CVE-2017-6439
https://security.archlinux.org/CVE-2017-6440

ArchLinux: 201705-18: libplist: multiple issues

May 17, 2017

Summary

- CVE-2017-5209 (information disclosure) The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
- CVE-2017-5545 (denial of service)
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
- CVE-2017-5834 (denial of service)
The parse_dict_node function in bplist.c in libplist allows attackersto cause a denial of service (out-of-bounds heap read and crash) via a crafted file.
- CVE-2017-5835 (denial of service)
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
- CVE-2017-5836 (denial of service)
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
- CVE-2017-6435 (denial of service)
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.
- CVE-2017-6436 (denial of service)
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
- CVE-2017-6437 (denial of service)
The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.
- CVE-2017-6438 (arbitrary command execution)
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
- CVE-2017-6439 (denial of service)
Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
- CVE-2017-6440 (denial of service)
The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.

Resolution

Upgrade to 2.0.0-1. # pacman -Syu "libplist>=2.0.0-1"
The problems have been fixed upstream in version 2.0.0.

References

https://github.com/libimobiledevice/libplist/issues/93 https://github.com/libimobiledevice/libplist/issues/94 https://github.com/libimobiledevice/libplist/issues/95 https://github.com/libimobiledevice/libplist/issues/99 https://github.com/libimobiledevice/libplist/issues/98 https://github.com/libimobiledevice/libplist/issues/100 https://github.com/libimobiledevice/libplist/blob/master/NEWS https://bugzilla.redhat.com/show_bug.cgi?id=1412613 https://bugzilla.redhat.com/show_bug.cgi?id=1416002 https://bugzilla.redhat.com/show_bug.cgi?id=1418591 https://bugzilla.redhat.com/show_bug.cgi?id=1418592 https://bugzilla.redhat.com/show_bug.cgi?id=1418593 https://security.archlinux.org/CVE-2017-5209 https://security.archlinux.org/CVE-2017-5545 https://security.archlinux.org/CVE-2017-5834 https://security.archlinux.org/CVE-2017-5835 https://security.archlinux.org/CVE-2017-5836 https://security.archlinux.org/CVE-2017-6435 https://security.archlinux.org/CVE-2017-6436 https://security.archlinux.org/CVE-2017-6437 https://security.archlinux.org/CVE-2017-6438 https://security.archlinux.org/CVE-2017-6439 https://security.archlinux.org/CVE-2017-6440

Severity
CVE-2017-5836 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437
CVE-2017-6438 CVE-2017-6439 CVE-2017-6440
Package : libplist
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-215

Workaround

None.

Related News