PCBSD 9 KDE Desktop

If you’re new to FreeBSD and PC-BSD, you might not yet be aware of all their package manager’s many commands. Nobody expects you to, at least not initially.

Pkg is that package manager and one of the its many commands I think you should get to know asap is the audit command. It’s used to audit installed packages against known vulnerabilities. I could be wrong, but I don’t think your favorite Linux distribution’s package manager has an equivalent command.

The command is very simple. Just pass the -F flag to pkg audit and it will output installed packages with outstanding vulnerabilities. By running pkg audit -F on a fresh installation of PC-BSD 10.1 KDE, for example, it reported the following vulnerable packages.

Fetching vuln.xml.bz2: 100%  458 KB 469.5k/s    00:01    
dbus-1.8.8 is vulnerable:
dbus -- incomplete fix for CVE-2014-3636 part A
CVE: CVE-2014-7824
WWW: http://portaudit.FreeBSD.org/c1930f45-6982-11e4-80e1-bcaec565249c.html

kde-runtime-4.14.2 is vulnerable:
kwebkitpart, kde-runtime -- insufficient input validation
CVE: CVE-2014-8600
WWW: http://portaudit.FreeBSD.org/890b6b22-70fa-11e4-91ae-5453ed2e2b49.html

kde-workspace-4.11.13 is vulnerable:
kde-workspace -- privilege escalation
CVE: CVE-2014-8651
WWW: http://portaudit.FreeBSD.org/dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49.html

libssh-0.6.1_1 is vulnerable:
libssh -- PRNG state reuse on forking servers
CVE: CVE-2014-0017
WWW: http://portaudit.FreeBSD.org/f8c88d50-5fb3-11e4-81bd-5453ed2e2b49.html

wget-1.15_2 is vulnerable:
wget -- path traversal vulnerability in recursive FTP mode
CVE: CVE-2014-4877
WWW: http://portaudit.FreeBSD.org/ee7b4f9d-66c8-11e4-9ae1-e8e0b722a85e.html

5 problem(s) in the installed packages found.

For each vulnerable package, it points you to a Web resources for more information. Visiting the link for libssh-0.6.1_1 vulnerability, gave the following information:

Aris Adamantiadis reported the following to us:

I have found a vulnerability in stunnel (fork mode) and libssh server (if implemented with fork) that is similar to problems found in postgresql [1]. When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn’t reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.

stunnel uses libssl, which also seeds the PRNG with the output of time(NULL), which means that vulnerability has to be exploited under a second. I have exploit code that can reproduce the issue on OpenBSD 5.4 (thanks to random PIDs) but I think it may be exploitable on other unix systems as well.

The following CVEs have been assigned:

CVE-2014-0016 stunnel PRNG vulnerability
CVE-2014-0017 libssh PRNG vulnerability

Mitigations implemented into openssl-0.9.8j (2009) makes the vulnerability not exploitable in stock openssl. The signing code for ECDSA and DSA explicitly seeds the pool with the digest to sign.

Even if your technical understanding of the vulnerability is nothing to rave about, at least you’re informed. The same command run on a new installation of PC-BSD 10.1.1 Cinnamon returned this output:

chromium-39.0.2171.95_3 is vulnerable:
chromium -- multiple vulnerabilities
CVE: CVE-2015-1205
CVE: CVE-2014-7948
CVE: CVE-2014-7947
CVE: CVE-2014-7946
CVE: CVE-2014-7945
CVE: CVE-2014-7944
CVE: CVE-2014-7943
CVE: CVE-2014-7942
CVE: CVE-2014-7941
CVE: CVE-2014-7940
CVE: CVE-2014-7939
CVE: CVE-2014-7938
CVE: CVE-2014-7937
CVE: CVE-2014-7936
CVE: CVE-2014-7935
CVE: CVE-2014-7934
CVE: CVE-2014-7933
CVE: CVE-2014-7932
CVE: CVE-2014-7931
CVE: CVE-2014-7930
CVE: CVE-2014-7929
CVE: CVE-2014-7928
CVE: CVE-2014-7927
CVE: CVE-2014-7926
CVE: CVE-2014-7925
CVE: CVE-2014-7924
CVE: CVE-2014-7923
WWW: http://vuxml.FreeBSD.org/freebsd/e30e0c99-a1b7-11e4-b85c-00262d5ed8ee.html

chromium-39.0.2171.95_3 is vulnerable:
chromium -- multiple vulnerabilities
CVE: CVE-2015-1212
CVE: CVE-2015-1211
CVE: CVE-2015-1210
CVE: CVE-2015-1209
WWW: http://vuxml.FreeBSD.org/freebsd/a6eb239f-adbe-11e4-9fce-080027593b9a.html

linux-c6-openssl-1.0.1e_2 is vulnerable:
OpenSSL -- multiple vulnerabilities
CVE: CVE-2015-0206
CVE: CVE-2015-0205
CVE: CVE-2015-0204
CVE: CVE-2014-8275
CVE: CVE-2014-3572
CVE: CVE-2014-3571
CVE: CVE-2014-3570
CVE: CVE-2014-3569
WWW: http://vuxml.FreeBSD.org/freebsd/4e536c14-9791-11e4-977d-d050992ecde8.html

2 problem(s) in the installed packages found.

Again, you’re given links for each vulnerability. If you run a FreeBSD Cloud server, that is one command you want to be running often. For the record, I ran it on my FreeBSD 10.1 DigitalOcean server and it reported zero vulnerable packages. I can rest easy, until the next audit.

Related Post:  5 awesome security features to expect in PC-BSD 10.1.2

Share:

Share on facebook
Facebook
Share on twitter
Twitter
Share on pinterest
Pinterest
Share on linkedin
LinkedIn

Hola! Did you notice that LinuxBSDos.com no longer runs network ads?  Yep, no more ads from the usual suspects that track you across the Internet.  But since  I still need to pay to keep the site running, feel free to make a small donation by PayPal.

Subscribe for updates. Trust me, no spam!

Mailchimp Signup Form

Sponsored links

1. Attend Algorithm Conference, a top AI and ML event for 2020.
2. Reasons to use control panel for your server.
3. DHgate Computers Electronics, Cell Phones & more.

Leave a Reply

Your email address will not be published. Required fields are marked *

Get the latest

On social media
Via my newsletter
Mailchimp Signup Form

Partner links

1. Attend Algorithm Conference, a top AI and ML event for 2021.
2. Reasons to use control panel for your server.
3. DHgate Computers Electronics, Cell Phones & more.
Hacking, pentesting distributions

Linux Distributions for Hacking

Experts use these Linux distributions for hacking, digital forensics, and pentesting.

Categories
Archives

The authors of these books are confirmed to speak during

Algorithm Conference

T-minus AI

Author was the first chairperson of AI for the U.S. Air Force.

The case for killer robots

Author is the Director of the Center for Natural and Artificial Intelligence.

Why greatness cannot be planned

Author works on AI safety as a Senior Research Scientist at Uber AI Labs.

Anastasia Marchenkova

An invitation from Anastasia Marchenkova

Hya, after stints as a quantum researcher at Georgia Tech Quantum Optics & Quantum Telecom Lab, and the University of Maryland Joint Quantum Institute, I’m now working on superconducting qubit quantum processors at Bleximo. I’ll be speaking during Algorithm Conference in Austin, Texas, July 16 – 18, 2020. Meet me there and let’s chat about progress and hype in quantum computing.