ubuntu-security-announce Digest, Vol 117, Issue 14

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-2254-2] PHP updates (Marc Deslauriers)
2. [USN-2255-1] OpenStack Neutron vulnerabilities (Jamie Strandboge)
3. [USN-2256-1] Swift vulnerability (Jamie Strandboge)


----------------------------------------------------------------------

Message: 1
Date: Wed, 25 Jun 2014 15:47:30 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2254-2] PHP updates
Message-ID: <53AB2752.2090603@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2254-2
June 25, 2014

php5 updates
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 13.10

Summary:

An improvement was made for PHP FPM environments.

Software Description:
- php5: HTML-embedded scripting language interpreter

Details:

USN-2254-1 fixed vulnerabilities in PHP. The fix for CVE-2014-0185
further restricted the permissions on the PHP FastCGI Process Manager (FPM)
UNIX socket. This update grants socket access to the www-data user and
group so installations and documentation relying on the previous socket
permissions will continue to function.

Original advisory details:

Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM)
set incorrect permissions on the UNIX socket. A local attacker could use
this issue to possibly elevate their privileges. This issue only affected
Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0185)
Francisco Alonso discovered that the PHP Fileinfo component incorrectly
handled certain CDF documents. A remote attacker could use this issue to
cause PHP to hang or crash, resulting in a denial of service.
(CVE-2014-0237, CVE-2014-0238)
Stefan Esser discovered that PHP incorrectly handled DNS TXT records. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2014-4049)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
php5-fpm 5.5.9+dfsg-1ubuntu4.2

Ubuntu 13.10:
php5-fpm 5.5.3+dfsg-1ubuntu2.5

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2254-2
http://www.ubuntu.com/usn/usn-2254-1
https://launchpad.net/bugs/1334337

Package Information:
https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.2
https://launchpad.net/ubuntu/+source/php5/5.5.3+dfsg-1ubuntu2.5


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140625/43c41ebe/attachment-0001.pgp>

------------------------------

Message: 2
Date: Wed, 25 Jun 2014 16:45:47 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2255-1] OpenStack Neutron vulnerabilities
Message-ID: <53AB430B.8090403@canonical.com>
Content-Type: text/plain; charset="utf-8"


==========================================================================
Ubuntu Security Notice USN-2255-1
June 25, 2014

neutron vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 13.10

Summary:

Several security issues were fixed in OpenStack Neutron.

Software Description:
- neutron: OpenStack Virtual Network Service

Details:

Darragh O'Reilly discovered that the Ubuntu packaging for OpenStack Neutron
did not properly set up its sudo configuration. If a different flaw was
found in OpenStack Neutron, this vulnerability could be used to escalate
privileges. (CVE-2013-6433)

Stephen Ma and Christoph Thiel discovered that the openvswitch-agent in
OpenStack Neutron did not properly perform input validation when creating
security group rules when specifying --remote-ip-prefix. A remote
authenticated attacker could exploit this to prevent application of
additional rules. (CVE-2014-0187)

Thiago Martins discovered that OpenStack Neutron would inappropriately
apply SNAT rules to IPv6 subnets when using the L3-agent. A remote
authenticated attacker could exploit this to prevent floating IPv4
addresses from being attached throughout the cloud. (CVE-2014-4167)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
python-neutron 1:2014.1-0ubuntu1.3

Ubuntu 13.10:
python-neutron 1:2013.2.3-0ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2255-1
CVE-2013-6433, CVE-2014-0187, CVE-2014-4167

Package Information:
https://launchpad.net/ubuntu/+source/neutron/1:2014.1-0ubuntu1.3
https://launchpad.net/ubuntu/+source/neutron/1:2013.2.3-0ubuntu1.5




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140625/06767aa8/attachment-0001.pgp>

------------------------------

Message: 3
Date: Wed, 25 Jun 2014 16:56:19 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2256-1] Swift vulnerability
Message-ID: <53AB4583.9060603@canonical.com>
Content-Type: text/plain; charset="utf-8"


==========================================================================
Ubuntu Security Notice USN-2256-1
June 25, 2014

swift vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Swift did not properly perform input validation of certain HTTP headers.

Software Description:
- swift: OpenStack distributed virtual object store

Details:

John Dickinson discovered that Swift did not properly quote the
WWW-Authenticate header value. If a user were tricked into navigating to a
malicious Swift URL, an attacker could conduct cross-site scripting
attacks. With cross-site scripting vulnerabilities, if a user were tricked
into viewing server output during a crafted server request, a remote
attacker could exploit this to modify the contents, or steal confidential
data, within the same domain.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
python-swift 1.13.1-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2256-1
CVE-2014-3497

Package Information:
https://launchpad.net/ubuntu/+source/swift/1.13.1-0ubuntu1.1




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140625/63a07421/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 117, Issue 14
*********************************************************