Amazon Linux AMI update for ecs-service-connect-agent



Risk High
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2023-35941
CVE-2023-35942
CVE-2023-35943
CVE-2023-35944
CVE-2023-35945
CWE-ID CWE-116
CWE-416
CWE-20
CWE-401
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
 Amazon Linux AMI
Operating systems & Components / Operating system

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Improper Encoding or Escaping of Output

EUVDB-ID: #VU78678

Risk: High

CVSSv4.0: 7.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2023-35941

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper encoding or escaping of output. A remote attacker can construct credentials with permanent validity.

Mitigation

Update the affected packages:

aarch64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.aarch64

src:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.src

x86_64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-300.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Use-after-free

EUVDB-ID: #VU78682

Risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2023-35942

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the gRPC access logger extension. A remote user can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.aarch64

src:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.src

x86_64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-300.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Use-after-free

EUVDB-ID: #VU78681

Risk: Medium

CVSSv4.0: 5.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2023-35943

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the HTTP CORS filter. A remote user can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.aarch64

src:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.src

x86_64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-300.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Input validation error

EUVDB-ID: #VU78679

Risk: High

CVSSv4.0: 7.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2023-35944

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect handling of requests and responses with mixed case schemes. A remote attacker can pass specially crafted input to the application and bypass some requests with mixed schemes.

Mitigation

Update the affected packages:

aarch64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.aarch64

src:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.src

x86_64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-300.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Memory leak

EUVDB-ID: #VU78293

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-35945

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when handling HTTP/2 requests within the nghttp2 codec. A remote attacker can send RST_STREAM immediately followed by the GOAWAY frames to the application and force memory leak.

Mitigation

Update the affected packages:

aarch64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.aarch64

src:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.src

x86_64:
    ecs-service-connect-agent-v1.26.4.0-1.amzn2023.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-300.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###