Security Update: Red Hat Linux DHCP Client

[2018-05-19]

All the affected Cloud Images has been updated.

--------

A new security vulnerability in the DHCP client implementation of Red Hat Linux has been discovered. The vulnerability, tracked as CVE-2018-1111, could allow attackers to execute arbitrary commands with root privileges on targeted systems. This issue affects Red Hat, Oracle Enterprise Linux, and CentOS servers. For further information, check the Red Hat official announcement.

The command injection flaw resides in the NetworkManager integration script included in the DHCP client packages. A malicious DHCP server or an attacker on the local network able to spoof DHCP responses could use this vulnerability to execute arbitrary commands with root privileges on systems. This is possible by configuring the NetworkManager to obtain network configuration using the DHCP protocol. Red Hat has confirmed that this vulnerability impacts both the Red Hat Enterprise Linux 6 and 7. It is strongly recommended to update the dhclient package (as soon as the newer versions will be available) if you are running one of these affected versions.

We believe it is of the utmost importance to quickly address any security issues in applications distributed by Bitnami. Our team is working to update all of the affected Cloud Images available through Bitnami for all Cloud Providers. We will keep you updated in this blog post.

How to mitigate the issue

In the meantime, you can mitigate this problem by updating the tool using the package manager included in the affected systems (yum).

  sudo yum install dhcp-common

Once updated, you will have one of the following versions:

• RedHat:           4.2.5-68.el7_5.1
• CentOS:           4.2.5-68.el7.centos.1
• Oracle Server:  4.2.5-68.0.1.el7_5.1 

Red Hat warns: "Users have the option to remove or deactivate the vulnerable script, but this will prevent certain configuration parameters provided by the DHCP server from being configured on a local system, such as addresses of the local NTP or NIS servers".

How to obtain the installed version of the package

To check the currently installed version on your system:

  sudo yum -q info installed dhcp-common

If you have additional questions about this security issue, post them in our community forum, and we will be happy to help you.

Security Notification: glibc getaddrinfo() stack-based buffer overflow (CVE-2015-7547)

It was discovered that the GNU C Library incorrectly handled receiving responses while performing DNS resolution. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. You can find more information about the issue in this post:

All versions of glibc after 2.9 are vulnerable. Version 2.9 was introduced in May 2008.

We believe it is of the utmost importance to quickly address any security issues in applications distributed by Bitnami. Our team is working to update all of the affected Virtual Machines and Cloud Images available through Bitnami for all Cloud Providers.

Please take a moment to check if your image is vulnerable by following the instructions in our wiki:
https://wiki.bitnami.com/security/2016-02-17_glibc_getaddrinfo()_stack-based_buffer_overflow_(CVE-2015-7547)

You can update your version of kernel by running one of the following commands that is specific to your distribution:

• Ubuntu

sudo apt-get update && sudo apt-get install unattended-upgrades && sudo unattended-upgrade  

You will have the fixed version of the glibc library: 2.19-0ubuntu6.7

• Debian 

sudo apt-get update && sudo apt-get install unattended-upgrades && sudo unattended-upgrade 

You will have the fixed version of the glibc library: 2.13-38+deb7u10

• Oracle Linux 

sudo yum update glibc 

You will have the fixed version of the glibc library: 2.12-1.166.el6_7.7

• Amazon Linux 

sudo yum update glibc 

You will have the fixed version of the glibc library: glibc-2.17-106.166.amzn1.x86_64

• RedHat Linux

sudo yum update glibc 

You will have the fixed version of the glibc library: 2.12-1.166.el6_7.7

If you have any questions about this process, please post to our community support forum and we will be happy to help!

Security Notification: Linux kernel vulnerability (CVE-2016-0728)

UPDATE: January 22, 2016

As of this posting, all affected Bitnami virtual machines and cloud images have been patched for Linux kernel vulnerability CVE-2016-0728. This includes all downloadable virtual machines as as well as Bitnami images on Amazon AWS, Bitnami Cloud Hosting, Centurylink, Digital Ocean, Google Cloud Platform, Microsoft Azure, Oracle Cloud Platform, and VMware vCloud Air public clouds.

For instructions on how to patch currently running systems, please see below.

------------------------------------

A new security vulnerability in the linux kernel has been discovered. You can find out more information about it in this link.

Any Bitnami-packaged image that was launched before January 20th, 2016 could be vulnerable if it has the version 3.8 of the kernel or later.

We believe it is of the utmost importance to quickly address any security issues in applications distributed by Bitnami and our team is working to update all of the affected Virtual Machines and Cloud Images available through Bitnami for all Cloud Providers.

Please take a moment to check if your image is vulnerable by following the instructions in our wiki:

https://wiki.bitnami.com/security/2016-01-20_LINUX_KERNEL_VULNERABILITY_(CVE-2016-0728)


You can update the version of the kernel running the following commands (you must run the command specific to your distribution):

• Ubuntu 

sudo apt-get update && sudo apt-get dist-upgrade

You'll have the fixed version of the kernel after rebooting your server: 3.13.0-76-generic

• Debian 

sudo apt-get update && sudo apt-get dist-upgrade

You'll have the fixed version of the kernel after rebooting your server: 3.16.7-ckt20-1

• Oracle Linux 

sudo yum update
sudo yum upgrade

You'll have the fixed version of the kernel after rebooting your server: 3.8.13-118.2.5.el6uek.x86_64

• Amazon Linux 

sudo yum clean all
sudo yum update kernel

You'll have the fixed version of the kernel after rebooting your server: 4.1.13-19.31.amzn1.x86_64

• RedHat Linux. The version Red Hat 6.6 is not affected by this issue.

If you have any questions about this process, please post to our community support forum and we will be happy to help!