Vulnerabilities > CVE-2015-0886 - Integer Overflow OR Wraparound vulnerability in multiple products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
mindrot
fedoraproject
CWE-190
nessus

Summary

Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-3120.NASL
    descriptionSecurity fix for CVE-2015-0886 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2015-03-17
    plugin id81852
    published2015-03-17
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/81852
    titleFedora 22 : jBCrypt-0.4-1.fc22 (2015-3120)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2015-3120.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81852);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-0886");
      script_xref(name:"FEDORA", value:"2015-3120");
    
      script_name(english:"Fedora 22 : jBCrypt-0.4-1.fc22 (2015-3120)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Security fix for CVE-2015-0886
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1197815"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-March/151496.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7f78ad96"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected jBCrypt package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:jBCrypt");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:22");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/03/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/17");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^22([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 22.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC22", reference:"jBCrypt-0.4-1.fc22")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "jBCrypt");
    }
    
  • NASL familyCGI abuses
    NASL idJENKINS_SECURITY_ADVISORY_2017-02-01.NASL
    descriptionThe remote web server hosts a version of Jenkins that is prior to 2.44, or a version of Jenkins LTS prior to 2.32.2, or else a version of Jenkings Opertations Center that is 1.625.x.y prior to 1.625.22.1, 2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.x prior to 2.32.2.1, or else a version of Jenkins Enterprise that is 1.651.x.y prior to 1.651.22.1, 2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.z prior to 2.32.2.1. It is, therefore, affected by the following vulnerabilities : - A DOM-based cross-site scripting (XSS) vulnerability exists in jQuery Core due to improper validation of certain tags while being rendered using innerHTML. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the user
    last seen2020-06-01
    modified2020-06-02
    plugin id97609
    published2017-03-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97609
    titleJenkins < 2.44 / 2.32.x < 2.32.2, Jenkins Operations Center < 1.625.22.1 / 2.7.22.0.1 / 2.32.2.1, and Jenkins Enterprise < 1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(97609);
      script_version("1.11");
      script_cvs_date("Date: 2019/06/10 11:30:32");
    
      script_cve_id(
        "CVE-2011-4969",
        "CVE-2015-0886",
        "CVE-2016-9887",
        "CVE-2017-2598",
        "CVE-2017-2599",
        "CVE-2017-2600",
        "CVE-2017-2601",
        "CVE-2017-2602",
        "CVE-2017-2603",
        "CVE-2017-2604",
        "CVE-2017-2605",
        "CVE-2017-2606",
        "CVE-2017-2607",
        "CVE-2017-2608",
        "CVE-2017-2609",
        "CVE-2017-2610",
        "CVE-2017-2611",
        "CVE-2017-2612",
        "CVE-2017-2613",
        "CVE-2017-1000362"
      );
      script_bugtraq_id(
        58458,
        95948,
        95949,
        95951,
        95952,
        95953,
        95954,
        95955,
        95956,
        95957,
        95959,
        95960,
        95961,
        95962,
        95963,
        95964,
        95967
      );
    
      script_name(english:"Jenkins < 2.44 / 2.32.x < 2.32.2, Jenkins Operations Center < 1.625.22.1 / 2.7.22.0.1 / 2.32.2.1, and Jenkins Enterprise < 1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 Multiple Vulnerabilities");
      script_summary(english:"Checks the Jenkins version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server hosts a job scheduling and management system
    that is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote web server hosts a version of Jenkins that is prior to
    2.44, or a version of Jenkins LTS prior to 2.32.2, or else a version
    of Jenkings Opertations Center that is 1.625.x.y prior to 1.625.22.1,
    2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.x prior to 2.32.2.1, or else a
    version of Jenkins Enterprise that is 1.651.x.y prior to 1.651.22.1,
    2.7.x.0.y prior to 2.7.22.0.1, or 2.x.y.z prior to 2.32.2.1. It is,
    therefore, affected by the following vulnerabilities :
    
      - A DOM-based cross-site scripting (XSS) vulnerability
        exists in jQuery Core due to improper validation of
        certain tags while being rendered using innerHTML. An
        unauthenticated, remote attacker can exploit this, via
        a specially crafted request, to execute arbitrary script
        code in the user's browser session. (CVE-2011-4969)
    
      - An integer overflow condition exists in jBCrypt in the
        key stretching implementation in gensalt, within the
        crypt_raw() function, which is triggered when the
        'log_rounds' parameter is set to the maximum value (31).
        An unauthenticated, remote attacker can exploit this to
        cause log_rounds to perform zero rounds, allowing a
        brute-force attack to more easily determine the password
        hash. (CVE-2015-0886)
    
      - A cross-site request forgery vulnerability (XSRF) exists
        due to several URLs related to group and role management
        not requiring POST form submission. An unauthenticated,
        remote attacker can exploit this to create unused roles,
        delete unused roles, and set group descriptions. Note
        that only Jenkins Enterprise is affected by this issue.
        (CVE-2016-9887)
    
      - A flaw exists when sensitive data, such as passwords, is
        encrypted using AES-128 with electronic codebook mode
        (ECB). An authenticated, remote attacker can exploit
        this to disclose information about reused passwords.
        (CVE-2017-2598)
    
      - An unspecified flaw exists that is triggered when
        handling new items due to insufficient permission
        checks. An authenticated, remote attacker can exploit
        this, by using the name of an already existing item, to
        create a new item that overwrites the existing item or
        to gain access to related objects. (CVE-2017-2599)
    
      - An information disclosure vulnerability exists due to
        improper permissions being set for accessing node
        monitor data via the remote API. An authenticated,
        remote attacker can exploit this to disclose system
        configuration and runtime information. (CVE-2017-2600)
    
      - A stored cross-site scripting (XSS) vulnerability exists
        due to improper validation of input to names and
        descriptions fields before returning it to users. An
        authenticated, remote attacker can exploit this, via a
        specially crafted request, to execute arbitrary script
        code in a user's browser session. (CVE-2017-2601)
    
      - A flaw exists in the Agent-to-Master Security Subsystem
        because build metadata from the Pipeline suite is not
        properly blacklisted. An authenticated, remote attacker
        can exploit this to overwrite metadata files.
        (CVE-2017-2602)
    
      - A flaw exists in the config.xml API when handling
        user-initiated agent disconnects, which results in User
        objects being included in the agent API output. An
        authenticated, remote attacker can exploit this to
        disclose sensitive information (e.g., user API tokens).
        (CVE-2017-2603)
    
      - A flaw exists when handling permissions for
        administrative monitors that allows an authenticated,
        remote attacker to access certain provided actions.
        (CVE-2017-2604)
    
      - A flaw exists in the Re-Key Admin Monitor when
        re-encrypting secrets with a new key that results in old
        secrets, including the encryption key, being stored
        with world-readable permissions. A local attacker can
        exploit this to disclose sensitive information from the
        backup files. (CVE-2017-2605)
    
      - A flaw exists in the internal API, specifically within
        the Jenkins::getItems() function, when requesting a list
        of items via UnprotectedRootAction. An authenticated,
        remote attacker can exploit this to disclose information
        regarding otherwise restricted items. (CVE-2017-2606)
    
      - A stored cross-site scripting (XSS) vulnerability exists
        due to improper validation of input passed via
        serialized console notes before returning it to users in
        build logs. An authenticated, remote attacker can
        exploit this, via a specially crafted request, to
        execute arbitrary script code in a user's browser
        session. (CVE-2017-2607)
    
      - A flaw exists in the XStream-based API due to improper
        validation of user-supplied input before it is
        deserialized. An authenticated, remote attacker can
        exploit this, via a specially crafted request, to
        execute arbitrary code. (CVE-2017-2608)
    
      - A flaw exists in the search box implementation due to
        the autocompletion feature displaying the names of
        restricted views. An authenticated, remote attacker can
        exploit this to disclose sensitive names of views.
        (CVE-2017-2609)
    
      - A stored cross-site scripting (XSS) vulnerability exists
        due to improper validation of input passed in user names
        before returning it to users. An authenticated, remote
        attacker can exploit this, via a specially crafted
        request, to execute arbitrary script code in a user's
        browser session. (CVE-2017-2610)
    
      - A flaw exists due to improper validation of permissions
        to the /workspaceCleanup and /fingerprintCleanup URLs.
        An authenticated, remote attacker can exploit this to
        cause a high load on the master and agents.
        (CVE-2017-2611)
    
      - A flaw exists due to a failure to properly restrict
        access to JDK download credentials. An authenticated,
        remote attacker can exploit this to overwrite the
        credentials, thereby causing builds to fail.
        (CVE-2017-2612)
    
      - A cross-site request forgery (XSRF) vulnerability exists
        due to a failure by HTTP GET requests to /user to
        require multiple steps, explicit confirmation, or a
        unique token when performing certain sensitive actions.
        An unauthenticated, remote attacker can exploit this, by
        convincing a user to follow a specially crafted link, to
        cause the creation of new temporary users.
        (CVE-2017-2613)
    
      - An information disclosure vulnerability which exists in 
        its re-key admin monitor component due to world readable 
        permissions being set on the directory it creates to 
        store secret information. An unauthenticated, remote 
        attacker can exploit this to disclose information 
        contained in this directory.
        (CVE-2017-1000362)");
    
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2017-02-01/");
      script_set_attribute(attribute:"see_also", value:"https://www.cloudbees.com/cloudbees-security-advisory-2017-02-01");
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/changelog/");
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/changelog-stable/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade Jenkins to version 2.44 or later, Jenkins LTS to version
    2.32.2 or later, or Jenkins Operations Center to version 1.625.22.1 /
    2.7.22.0.1 / 2.32.2.1 or later, or Jenkins Enterprise to version
    1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-2608");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/07/29");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/02/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/08");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("jenkins_detect.nasl");
      script_require_ports("Services/www", 8080);
      script_require_keys("installed_sw/Jenkins");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("install_func.inc");
    
    app = "Jenkins";
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    port = get_http_port(default:8080);
    
    install = get_single_install(
      app_name : app,
      port     : port,
      exit_if_unknown_ver : TRUE
    );
    
    dir = install['path'];
    version = install['version'];
    edition = install['Edition'];
    app = app + " " + edition;
    install_url = build_url(port:port, qs:dir);
    fix = NULL;
    
    if (edition == "Enterprise")
    {
      if ( version =~ "^1\." )
        fix = "1.651.22.1";
      else if ( version =~ "^2\.7\.(\d)+\.0\." )
        fix = "2.7.22.0.1";
      else
        fix = "2.32.2.1";
    }
    else if (edition == "Operations Center")
    {
      if ( version =~ "^1\." )
        fix = "1.625.22.1";
      else if ( version =~ "^2\.7\.(\d)+\.0\." )
        fix = "2.7.22.0.1";
      else
        fix = "2.32.2.1";
    }
    else if (edition == "Open Source LTS")
    {
      fix = '2.32.2';
    }
    else if (edition == "Open Source")
    {
      fix = '2.44';
    }
    
    if (isnull(fix))
      audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, version);
    
    if (ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
    {
      order = make_list("URL", "Product", "Version", "Fixed Version");
      report = make_array(
        order[0], install_url,
        order[1], app,
        order[2], version,
        order[3], fix
      );
      report = report_items_str(report_items:report, ordered_fields:order);
    
      security_report_v4(port:port, severity:SECURITY_WARNING, extra:report, xss:TRUE, xsrf:TRUE);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, version);
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-2994.NASL
    descriptionSecurity fix for CVE-2015-0886 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2015-03-17
    plugin id81845
    published2015-03-17
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/81845
    titleFedora 20 : jBCrypt-0.4-1.fc20 (2015-2994)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-3032.NASL
    descriptionSecurity fix for CVE-2015-0886 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2015-03-17
    plugin id81847
    published2015-03-17
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/81847
    titleFedora 21 : jBCrypt-0.4-1.fc21 (2015-3032)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_5CFA9D0C73D74642AF4F28FBED9E9404.NASL
    descriptionJenkins Security Advisory : Please reference CVE/URL list for details
    last seen2020-06-01
    modified2020-06-02
    plugin id96939
    published2017-02-02
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96939
    titleFreeBSD : jenkins -- multiple vulnerabilities (5cfa9d0c-73d7-4642-af4f-28fbed9e9404)