Vulnerability Summary for the Week of September 17, 2018 The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9 Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9 Entries may include additional information provided by organizations and efforts sponsored by Ug-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of Ug-CERT analysis. High Vulnerabilities Primary CVSS Source & Vendor -- Product Description Published Score Patch Info There were no high vulnerabilities recorded this week. Back to top Medium Vulnerabilities Primary CVSS Source & Vendor -- Product Description Published Score Patch Info There were no medium vulnerabilities recorded this week. Back to top Low Vulnerabilities Primary CVSS Source & Vendor -- Product Description Published Score Patch Info There were no low vulnerabilities recorded this week. Back to top Severity Not Yet Assigned Source & Primary PublisCVSS Patch Vendor -- Product Description hed Score Info CVE- 2018- not 15546 Accusoft PrizmDoc version 13.3 and earlier yet CONFI accusoft -- prizmdoc contains a Stored Cross-Site Scripting issue 2018- calcul RM through a crafted PDF file. 09-18 ated MISC CVE- 2018- 8041 CONFI not RM Apache Camel's Mail 2.20.0 through 2.20.3, yet BID apache -- camel 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to 2018- calcul CONFI path traversal. 09-17 ated RM In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further CVE- locked down by defining a security manager 2018- policy that limits file system access to those 11786 directories beneath the Karaf home that are CONFI necessary for the system to run. However, this not RM still allows anyone with ssh access to the Karaf yet CONFI apache -- karaf process to read and write a large number of files 2018- calcul RM as the Karaf process user. 09-18 ated MLIST In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed CVE- in Karaf, it is available at .../system/console and 2018- requires authentication to access it. One part of 11787 the console is a Gogo shell/console that gives CONFI access to the command line console of Karaf via not RM a Web browser, and when navigated to it is yet CONFI available at .../system/console/gogo. Trying to apache -- karaf 2018- calcul RM go directly to that URL does require 09-18 ated MLIST authentication. And optional bundle that some Source & Primary PublisCVSS Patch Vendor -- Product Description hed Score Info applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised. Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse not CVE- the timing difference of when the JWT yet 2018- apache -- mesos validation function returns to reveal the correct 2018- calcul 8023 HMAC value. 09-21 ated MLIST CVE- not 2018- A potential Remote Code Execution bug exists yet 11780 apache -- spamassassin with the PDFInfo plugin in Apache 2018- calcul BID SpamAssassin before 3.4.2. 09-17 ated MLIST not CVE- yet 2018- apache -- spamassassin Apache SpamAssassin 3.4.2 fixes a local user 2018- calcul 11781 code injection in the meta rule syntax. 09-17 ated MLIST Source & Primary PublisCVSS Patch Vendor -- Product Description hed Score Info A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the CVE- wild but not believed to have been purposefully not 2017- part of a Denial of Service attempt. We are yet 15705 apache -- spamassassin concerned that there may be attempts to abuse 2018- calcul BID the vulnerability in the future. 09-17 ated MLIST In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. not CVE- They were therefore vulnerable to an entity yet 2018- apache -- tika expansion vulnerability which can lead to a 2018- calcul 11761 denial of service attack. 09-19 ated MLIST In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) not CVE- and the input file has an embedded file with an yet 2018- apache -- tika absolute path, such as "C:/evil.bat", tika-app 2018- calcul 11762 would overwrite that file. 09-19 ated MLIST not CVE- In Apache Tika 1.2 to 1.18, a carefully crafted yet 2018- apache -- tika file can trigger an infinite loop in the 2018- calcul 8017 IptcAnpaParser. 09-19 ated MLIST Source & Primary PublisCVSS Patch Vendor -- Product Description hed Score Info Artifex Ghostscript before 9.25 allowed a user- CVE- writable error exception table, which could be not 2018- used by remote attackers able to supply crafted yet 17183 artifex -- ghostscript PostScript to potentially overwrite or replace 2018- calcul MISC error handlers to inject code. 09-19 ated MISC blocking_request.cgi on ASUS GT-AC5300 devices through 3.0.0.4.384_32738 allows not CVE- remote attackers to cause a denial of service yet 2018- asus -- gt-ac5300 (NULL pointer dereference and device crash) 2018- calcul 17127 via a request that lacks a timestap parameter. 09-17 ated MISC CVE- 2018- The administrative smart-commits resource in 13398 Atlassian Fisheye and Crucible before version not CONFI 4.5.4 allows remote attackers to modify smart- yet RM atlassian -- fisheye_and_crucible commit settings via a Cross-site request forgery 2018- calcul CONFI (CSRF) vulnerability. 09-18 ated RM CVE- not 2018- The DEISER "Profields - Project Custom yet 16281 Fields" app before 6.0.2 for Jira has Incorrect 2018- calcul CONFI atlassian -- jira Access Control. 09-21 ated RM CVE- An issue has been discovered in mpruett Audio not 2018- File Library (aka audiofile) 0.3.6. A heap-based yet 17095 audiofile -- audiofile buffer overflow in Expand3To4Module::run has 2018- calcul MISC occurred when running sfconvert. 09-16 ated MISC A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration CVE- Designer could allow an attacker to add, change, not 2018- avaya -- or remove administrative settings. Affected yet 15612 aura_orchestration_designer versions of Avaya Aura Orchestration Designer 2018- calcul CONFI include all versions up to 7.2.1. 09-21 ated RM CVE- not 2018- A cross-site scripting (XSS) vulnerability in the avaya -- yet 15613 Runtime Config component of Avaya Aura aura_orchestration_designer 2018- calcul CONFI Orchestration Designer could result in malicious 09-21 ated RM content being returned to the user. Affected Source & Primary PublisCVSS Patch Vendor -- Product Description hed Score Info versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1. CVE- Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 2018- 0.15.2, and 0.16.x before 0.16.3 and Bitcoin 17144 Knots 0.14.x through 0.16.x before 0.16.3 allow not MISC a remote denial of service (application crash) yet MISC bitcoin_core -- bitcoin_core exploitable by miners via duplicate input.