From owner-svn-ports-all@FreeBSD.ORG Thu Oct 2 00:46:55 2014 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3AE4E2AF; Thu, 2 Oct 2014 00:46:55 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 1B97181B; Thu, 2 Oct 2014 00:46:55 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s920ks5R018759; Thu, 2 Oct 2014 00:46:54 GMT (envelope-from bdrewery@FreeBSD.org) Received: (from bdrewery@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s920ksXu018758; Thu, 2 Oct 2014 00:46:54 GMT (envelope-from bdrewery@FreeBSD.org) Message-Id: <201410020046.s920ksXu018758@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: bdrewery set sender to bdrewery@FreeBSD.org using -f From: Bryan Drewery Date: Thu, 2 Oct 2014 00:46:54 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r369787 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Oct 2014 00:46:55 -0000 Author: bdrewery Date: Thu Oct 2 00:46:54 2014 New Revision: 369787 URL: https://svnweb.freebsd.org/changeset/ports/369787 QAT: https://qat.redports.org/buildarchive/r369787/ Log: Document Jenkins vulnerabilities Security: CVE-2014-3661 Security: CVE-2014-3662 Security: CVE-2014-3663 Security: CVE-2014-3664 Security: CVE-2014-3680 Security: CVE-2014-3681 Security: CVE-2014-3666 Security: CVE-2014-3667 Security: CVE-2013-2186 Security: CVE-2014-1869 Security: CVE-2014-3678 Security: CVE-2014-3679 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Oct 2 00:27:02 2014 (r369786) +++ head/security/vuxml/vuln.xml Thu Oct 2 00:46:54 2014 (r369787) @@ -57,6 +57,100 @@ Notes: --> + + jenkins -- remote execution, privilege escalation, CXX, password exposure, ACL hole, Dos + + + jenkins + 1.583 + + + jenkins-lts + 1.565.3 + + + + +

Jenkins Security Advisory:

+
SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI + handshake) This vulnerability allows unauthenticated users with + access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins + through thread exhaustion. + + SECURITY-110/CVE-2014-3662 (User name discovery) Anonymous users + can test if the user of a specific name exists or not through login + attempts. + + SECURITY-127&128/CVE-2014-3663 (privilege escalation in job + configuration permission) An user with a permission limited to + Job/CONFIGURE can exploit this vulnerability to effectively create + a new job, which should have been only possible for users with + Job/CREATE permission, or to destroy jobs that he/she does not have + access otherwise. + + SECURITY-131/CVE-2014-3664 (directory traversal attack) Users with + Overall/READ permission can access arbitrary files in the file + system readable by the Jenkins process, resulting in the exposure + of sensitive information, such as encryption keys. + + SECURITY-138/CVE-2014-3680 (Password exposure in DOM) If a + parameterized job has a default value in a password field, that + default value gets exposed to users with Job/READ permission. + + SECURITY-143/CVE-2014-3681 (XSS vulnerability in Jenkins core) + Reflected cross-site scripting vulnerability in Jenkins core. An + attacker can navigate the user to a carefully crafted URL and have + the user execute unintended actions. + + SECURITY-150/CVE-2014-3666 (remote code execution from CLI) + Unauthenticated user can execute arbitrary code on Jenkins master + by sending carefully crafted packets over the CLI channel. + + SECURITY-155/CVE-2014-3667 (exposure of plugin code) Programs that + constitute plugins can be downloaded by anyone with the + Overall/READ permission, resulting in the exposure of otherwise + sensitive information, such as hard-coded keys in plugins, if any. + + SECURITY-159/CVE-2013-2186 (arbitrary file system write) Security + vulnerability in commons fileupload allows unauthenticated attacker + to upload arbitrary files to Jenkins master. + + SECURITY-149/CVE-2014-1869 (XSS vulnerabilities in ZeroClipboard) + reflective XSS vulnerability in one of the library dependencies of + Jenkins. + + SECURITY-113/CVE-2014-3678 (XSS vulnerabilities in monitoring + plugin) Monitoring plugin allows an attacker to cause a victim into + executing unwanted actions on Jenkins instance. + + SECURITY-113/CVE-2014-3679 (hole in access control) Certain pages + in monitoring plugin are visible to anonymous users, allowing them + to gain information that they are not supposed to.
+

+ + + + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 + CVE-2014-3661 + CVE-2014-3662 + CVE-2014-3663 + CVE-2014-3664 + CVE-2014-3680 + CVE-2014-3681 + CVE-2014-3666 + CVE-2014-3667 + CVE-2013-2186 + CVE-2014-1869 + CVE-2014-3678 + CVE-2014-3679 + + + 2014-10-01 + 2014-10-01 + + + bash -- remote code execution