SB2019121201 - Amazon Linux AMI update for git

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019121201

SB2019121201 - Amazon Linux AMI update for git

Published: December 12, 2019

Security Bulletin ID SB2019121201
Severity
High
Patch available
YES
Number of vulnerabilities 53
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 43% Medium 23% Low 34%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 53 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2019-13484)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the status-log viewer CGI because of   expansion in the "appfeed.c". A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Stack-based buffer overflow (CVE-ID: CVE-2019-13486)

The vulnerability allows a remote attacker to access or modify data, or cause a denial of service (DoS) condition on an affected system.

The vulnerability exists in the status-log viewer component due to a boundary error in the "svcstatus.c" file because the software does not properly validate user-supplied input. A remote unauthenticated attacker can submit malicious input, trigger stack-based buffer overflow and access or modify data, or cause a DoS condition on the affected system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Stack-based buffer overflow (CVE-ID: CVE-2019-13485)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a long hostname or service parameter in history.c within the in the history viewer component. A remote authenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Input validation error (CVE-ID: CVE-2019-1349)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.


5) Improper validation of integrity check value (CVE-ID: CVE-2019-13496)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the affected software does not validate or incorrectly validates the integrity check values. A remote attacker can perform a man-in-the-middle (MitM) attack, bypass OTP, replace a failed SAML response with a successful SAML response and gain access to the application.

6) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2019-13498)

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists due to the affected software does not use HTTP Strict Transport Security (HSTS). A remote attacker can perform perform a man-in-the-middle attack, steal credentials and manipulate content.

7) Cross-site request forgery (CVE-ID: CVE-2019-13497)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in logout requests. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


8) Input validation error (CVE-ID: CVE-2019-1350)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.


9) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2019-13509)

The vulnerability allows a local attacker to access sensitive information on a targeted system.

The vulnerability exists due to the software can add secrets to the debug log when the "docker stack deploy" command is used while running in debug mode to redeploy a stack which includes non-external secrets. A local authenticated attacker can gain access to sensitive information, such as secrets in the log files on a targeted system.

10) Stored cross-site scripting (CVE-ID: CVE-2019-13505)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks via the E-mail field.

The vulnerability exists due to insufficient sanitization of user-supplied data in a booking form. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


11) Out-of-bounds read (CVE-ID: CVE-2019-13504)

The vulnerability allows a remote attacker to cause a denial of service (DoS) condition on a targeted system.

The vulnerability exists due to an out-of-bounds read error in the "Exiv2::MrwImage::readMetadata" function in the "mrwimage.cpp" file. A remote attacker can create a specially crafted media file, trick the victim into opening it and cause the affected application to crash.


12) Absolute Path Traversal (CVE-ID: CVE-2019-1351)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to the Git for Visual Studio improperly handles virtual drive paths. A remote attacker can clone a file using a specially crafted path and write arbitrary files and directories to certain locations on a vulnerable system.



13) Type Confusion (CVE-ID: CVE-2019-13519)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing the .DOE files. A remote attacker can trick a victim to open a specially crafted .DOE file, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


14) Session Fixation (CVE-ID: CVE-2019-13517)

The vulnerability allows a local attacker to steal authenticated sessions.

The vulnerability exists due to the exists access privileges are not restricted in coordination with the expiration of access based on active directory user account changes when the device is joined to an Active Directory (AD) domain. A local authenticated user can use the AD credentials of a previously authenticated user to gain access to the device and obtain the patient data and medication.



15) Stack-based buffer overflow (CVE-ID: CVE-2019-13518)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the application. A remote attacker can send a specially crafted project file, trigger stack-based buffer overflow and execute arbitrary code under the privileges of the application. 

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


16) Information disclosure (CVE-ID: CVE-2019-13511)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the specific flaw exists within the processing of project files. A remote attacker can trick a victim to open a specially crafted Arena file and gain unauthorized access to sensitive information related to the targeted workstation.


17) Use-after-free (CVE-ID: CVE-2019-13510)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing the Arena files. A remote attacker can trick a victim to open a specially crafted Arena file and crash the application or execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


18) Out-of-bounds read (CVE-ID: CVE-2019-13512)

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the device. A local attacker can trigger out-of-bounds read error and read limited information from the device.


19) Protection Mechanism Failure (CVE-ID: CVE-2019-13516)

The vulnerability allows a local attacker to bypass certain restrictions.

The vulnerability exists due to the cross-site request forgery protection setting that has not taken effect. A local authenticated attacker can bypass certain security restrictions on the target system.

20) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2019-13515)

The vulnerability allows a remote attacker to access sensitive information on a targeted system.

The vulnerability exists due to the information written to log files can be of a sensitive nature or expose sensitive user information. A remote authenticated attacker can disclose sensitive information.

21) Use-after-free (CVE-ID: CVE-2019-13514)

The vulnerability allows a local attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a specially crafted project file. A local attacker can send a specially crafted project file, trigger a use-after-free vulnerability, gain sensitive information on the target system, execute arbitrary code, or crash the application.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


22) Out-of-bounds read (CVE-ID: CVE-2019-13513)

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing a specially crafted project file. A local attacker can create a specially crafted project file, trigger out-of-bounds read error and read contents of memory on the system and cause it to crash.


23) Input validation error (CVE-ID: CVE-2019-1352)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.


24) Missing Authentication for Critical Function (CVE-ID: CVE-2019-13525)

The vulnerability allows a remote attacker to access sensitive information on the target system.

The vulnerability exists due to the integrated web server does not perform any authentication for functionality that requires a provable user identity. A remote attacker can download configuration files directly through a URL without authentication and expose configuration and authorized visitor information.

25) Cross-site request forgery (CVE-ID: CVE-2019-13529)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


26) Command Injection (CVE-ID: CVE-2019-13521)

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to improper input validation when processing the .DOE files. A remote attacker can trick a victim to open a specially crafted .DOE file and execute arbitrary commands on the target system without prompting the user.

27) Access of uninitialized pointer (CVE-ID: CVE-2019-13527)

The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to the affected software accesses or uses a pointer that has not been initialized. A remote attacker can trick a victim to open a specially crafted Arena file, which results in the use of a pointer that has not been initialized and execute arbitrary code on the target system.


28) Improper Authorization (CVE-ID: CVE-2019-13528)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing authorization checks. A local authenticated user can gain read access to privileged files.

The following versions are vulnerable:
  • Niagara AX 3.8u4: 
    • OS Dist: 2.7.402.2
    • NRE Config Dist: 3.8.401.1
  • Niagara 4.4u3:
    • OS Dist: 4.4.73.38.1 NRE Config
    • Dist: 4.4.94.14.1
  • Niagara 4.7u1:
    • OS Dist: (JACE 8000) 4.7.109.16.1
    • OS Dist (Edge 10): 4.7.109.18.1
    • NRE Config Dist: 4.7.110.32.1

29) Improper access control (CVE-ID: CVE-2019-13523)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the integrated web server of the affected devices allows to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders). A remote attacker can gain unauthorized access to view device configuration information.


30) Buffer overflow (CVE-ID: CVE-2019-13522)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the application. A remote attacker can create a specially crafted project file, trick the victim into opening it, trigger memory corruption and execute arbitrary code under the privileges of the application.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


31) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2019-13526)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exist due to improper implementation of the authentication process. A remote authenticated attacker can bypass authentication through issues in the HTTP authentication process and execute arbitrary code on the target device.

32) Stack-based buffer overflow (CVE-ID: CVE-2019-13520)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the affected application when processing SDP files. A remote unauthenticated attacker can send a specially crafted project files, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


33) Reversible One-Way Hash (CVE-ID: CVE-2019-13539)

The vulnerability allows a local user to bypass authentication on the target system.

The vulnerability exists due to the the affected products use the decrypt algorithm for OS password hashing. While interactive, network-based logins are disable and local user can use other vulnerabilities to obtain local shell access and access these hashes.

34) Protection Mechanism Failure (CVE-ID: CVE-2019-13535)

The vulnerability allows a local attacker to bypass certain restrictions.

The vulnerability exists due to the RFID security mechanism does not apply read protection. An attacker with physical access to the device can gain full read access of the RFID security mechanism data.

35) Improper Authentication (CVE-ID: CVE-2019-13531)

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to an error in the RFID security mechanism used for authentication between the FT10/LS10 Energy Platform and instruments. An attacker with physical access to the device can connect inauthentic instruments to the generator, bypass authentication process and gain unauthorized access to the application.


36) Stack-based buffer overflow (CVE-ID: CVE-2019-13537)

The vulnerability allows a remote attacker to cause a server-side crash.

The vulnerability exists due to a boundary error in the IEC870IP driver. A remote unauthenticated attacker can trigger stack-based buffer overflow and cause a server-side crash on the target system.

Note: This vulnerability affects only the IEC870IP driver used in Vijeo Citect and Citect SCADA.

37) Download of code without integrity check (CVE-ID: CVE-2019-13534)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. A remote attacker with ability to perform a man-in-the-middle attack can execute arbitrary code on the target system.

38) Use of Hard-coded Password (CVE-ID: CVE-2019-13530)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. A remote attacker can use these credentials to login via ftp and upload a malicious firmware.

39) Path traversal (CVE-ID: CVE-2019-13532)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the CODESYS V3 web server. A remote attacker can send a specially crafted HTTP or HTTPS request and read arbitrary files outside the restricted working directory of the controller.


40) Cross-site scripting (CVE-ID: CVE-2019-13538)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the CODESYS V3 Library Manager. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


41) Heap-based buffer overflow (CVE-ID: CVE-2019-13536)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing specially crafted project files. A remote attacker can send a specially crafted project file, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


42) Input validation error (CVE-ID: CVE-2019-1354)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system.


43) Use of hard-coded credentials (CVE-ID: CVE-2019-13543)

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials and read files on the target system.



44) Missing Authorization (CVE-ID: CVE-2019-13547)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the an unsecured function. A remote attacker can access the IP address, use the function without authentication and gain access to the target system.

45) Missing Authentication for Critical Function (CVE-ID: CVE-2019-13549)

The vulnerability allows a remote attacker to disrupt the primary operations.

The vulnerability exists due to the authentication mechanism does not provide a sufficient level of protection against unauthorized configuration changes. A remote attacker can modify without authentication the primary operations, namely turn the cooling unit on and off and set the temperature set point.

46) Exposure of resource to wrong sphere (CVE-ID: CVE-2019-13546)

The vulnerability allows a local attacker to gain access to system resources.

The vulnerability exists due to the error that allows to bypass a lock screen of the Windows operating system when the software is running. An attacker with physical access to the system can bypass the Windows lock screen and gain unauthorized access to the computer.

47) Out-of-bounds write (CVE-ID: CVE-2019-13545)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.


48) Input validation error (CVE-ID: CVE-2019-13541)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can access sensitive information and execute arbitrary code.


49) Stack-based buffer overflow (CVE-ID: CVE-2019-13548)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the CODESYS V3 web server. A remote unauthenticated attacker can send a specially crafted HTTP or HTTPS request, trigger stack-based buffer overflow and cause a denial-of-service condition or execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


50) NULL pointer dereference (CVE-ID: CVE-2019-13542)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing requests. A remote authenticated attacker can send a specially crafted request from a trusted OPC UA client and perform a denial of service (DoS) attack.


51) Out-of-bounds write (CVE-ID: CVE-2019-13544)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted project file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.


52) Stack-based buffer overflow (CVE-ID: CVE-2019-13540)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing specially crafted project files. A remote unauthenticated attacker can send a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


53) Input validation error (CVE-ID: CVE-2019-1387)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Git for Visual Studio. A remote attacker can convince the user to clone a malicious repo and execute arbitrary code on the target system. 


Remediation

Install update from vendor's website.

References