Difference between revisions of "Security Advisories"

From ArchWiki
Jump to navigation Jump to search
(wordpress advisory)
(→‎Recent Advisories: fixed chromium)
Line 16: Line 16:
  
 
=== September 2016 ===
 
=== September 2016 ===
 +
* [03 October  2016] [https://lists.archlinux.org/pipermail/arch-security/2016-September/000729.html ASA-201610-1] {{pkg|chromium}} arbitrary code execution
 
* [30 September 2016] [https://lists.archlinux.org/pipermail/arch-security/2016-September/000728.html ASA-201609-32] {{pkg|wordpress}} multiple issues
 
* [30 September 2016] [https://lists.archlinux.org/pipermail/arch-security/2016-September/000728.html ASA-201609-32] {{pkg|wordpress}} multiple issues
 
* [30 September 2016] [https://lists.archlinux.org/pipermail/arch-security/2016-September/000727.html ASA-201609-31] {{pkg|c-ares}} arbitrary code execution
 
* [30 September 2016] [https://lists.archlinux.org/pipermail/arch-security/2016-September/000727.html ASA-201609-31] {{pkg|c-ares}} arbitrary code execution

Revision as of 21:26, 3 October 2016

Related articles

Security Advisories are published by the community driven Arch CVE Monitoring Team to the public arch-security list. All published advisories can be found below, however if you want to be up-to-date its recommended to subscribe to the list. All assigned CVE's are tracked at the relevant CVE page CVE, by the ACMT.

Scheduled Advisories

Recent Advisories

Here is an archive of security advisories posted to the arch-security list.

September 2016

August 2016

July 2016

June 2016

May 2016

April 2016

March 2016

February 2016

January 2016

December 2015

November 2015

October 2015

September 2015

August 2015

July 2015

June 2015

May 2015

Apr 2015

Mar 2015

Feb 2015

Jan 2015

Dec 2014

Nov 2014

Oct 2014

Sep 2014

Publishing a new advisory

We try to always wait for the vulnerability to have been fixed in the corresponding package before issuing an advisory. In case of an extremely critical vulnerability, we may issue an advisory before the package has been fixed, but only if a work-around exists.

If you want to publish a new advisory, please check that:

  • the corresponding Arch Linux package is really vulnerable ;
  • the tracking Procedure has been completed;
  • no Arch Linux Security Advisory for this vulnerability has been published yet ;
  • no upcoming Security Advisory for this vulnerability has been claimed in the "Scheduled Advisories" list of this page, as it would mean that someone is already working on an advisory ;
  • the current maintainer has been notified, either by flagging the package ouf-of-date if an upstream release fixing the issue exists and/or by creating a new bug-tracker entry (see the exact procedure here).

You may then:

  • add a line in the "Scheduled Advisories" list of this page, indicating that you are going to publish an advisory soon ;
  • use the following template as an example to write the advisory ;
  • ensure that every line in the advisory is properly wrapped after 72 characters
  • send the advisory to the arch-security mailing-list (note that it would be nice if you could send a PGP-signed e-mail, but it is not required).
  • move the published advisory from "Scheduled Advisories" to "Recent Advisories"
  • adapt the CVE tracking page for the fixed package and add a link to the appropriate ASA.

Templates

Subject:
[ASA-<YYYYMM-N>] <Package>: <Vulnerability Type>

Body:
Arch Linux Security Advisory ASA-YYYYMM-N
=========================================

Severity: Low, Medium, High, Critical
Date    : YYYY-MM-DD
CVE-ID  : <CVE-ID>
Package : <package>
Type    : <Vulnerability Type>
Remote  : <Yes/No>
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package <package> before version <Arch Linux fixed version> is vulnerable to <Vulnerability type>.

Resolution
==========

Upgrade to <Arch Linux fixed version>.

# pacman -Syu "<package>>=<Arch Linux fixed version>"

The problem has been fixed upstream in version <upstream fixed version>.

Workaround
==========

<Is there a way to mitigate this vulnerability without upgrading?>

Description
===========

<Long description, for example from original advisory>.

Impact
======

<
What is it that an attacker can do? Does this need existing
pre-conditions to be exploited (valid credentials, physical access)?
Is this remotely exploitable?
>.

References
==========

<CVE-Link>
<Upstream report>
<Arch Linux Bug-Tracker>

Vim-Snippet

Vim-Snippet for vim-ultisnips plugin for easy completing the archlinux template. Just install vim-ultisnips and copy the text below in your ~/.vim/UltiSnips/all.snippets you can jump through the tabstops with CTRL+j. 

snippet archsec "arch security form"                                                                                   
Arch Linux Security Advisory ASA-`date -I -u | egrep -o '[0-9]{4}'``date -I -u | egrep -o '[0-9]{2}' | sed '3q;d'`-${1}
========================================${1/./=/g}                                                                     

Severity: ${2}                                                                                                         
Date    : `date -I -u`                                                                                                 
CVE-ID  : $3                                                                                                           
Package : $4                                                                                                           
Type    : $5
Remote  : ${6}                                                                                                         
Link    : https://wiki.archlinux.org/index.php/CVE                                                                     
                                                                                                                       
Summary
=======
                                                                                                                       
The package $4 before version $7 is vulnerable to $5 ${8}                                                              
                                                                                                                       
Resolution
==========
                                                                                                                       
Upgrade to $7.
                                                                                                                       
# pacman -Syu "$4>=$7"                                                                                                 
                                                                                                                       
${9:The problems have been fixed upstream in version ${7/-\d+$/./}}                                                    
                                                                                                                       
Workaround
==========                                                                                                             
                                                                                                                       
${10:None.}                                                                                                            

Description                                                                                                            
===========                                                                                                            

${3/(CVE-....-....)(\s?)/- $1(?2: : )()\n\n/g}                                                                         

Impact
======                                                                                                                 

A${6/(Yes)|(No)/(?1: remote )(?2: local )/}attacker is able to ${12}                                                   

References
==========                                                                                                             
                                                                                                                       
${3/(CVE-....-....)(\s?)/https:\/\/access.redhat.com\/security\/cve\/$1\n/g}
${13}
endsnippet
Retrieved from "https://wiki.archlinux.org/index.php?title=Security_Advisories&oldid=452829"