From owner-svn-ports-head@FreeBSD.ORG Fri Oct 31 11:09:18 2014 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B17AC164; Fri, 31 Oct 2014 11:09:18 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 92CBAFCD; Fri, 31 Oct 2014 11:09:18 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s9VB9I9Q056621; Fri, 31 Oct 2014 11:09:18 GMT (envelope-from rea@FreeBSD.org) Received: (from rea@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s9VB9IRl056620; Fri, 31 Oct 2014 11:09:18 GMT (envelope-from rea@FreeBSD.org) Message-Id: <201410311109.s9VB9IRl056620@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: rea set sender to rea@FreeBSD.org using -f From: Eygene Ryabinkin Date: Fri, 31 Oct 2014 11:09:18 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r371804 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2014 11:09:18 -0000 Author: rea Date: Fri Oct 31 11:09:17 2014 New Revision: 371804 URL: https://svnweb.freebsd.org/changeset/ports/371804 QAT: https://qat.redports.org/buildarchive/r371804/ Log: VuXML: document vulnerability in Jenkins CVE-2014-3665, remote code execution on master servers that can be initiated by (untrusted) slaves, https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Oct 31 11:08:44 2014 (r371803) +++ head/security/vuxml/vuln.xml Fri Oct 31 11:09:17 2014 (r371804) @@ -57,6 +57,59 @@ Notes: --> + + jenkins -- slave-originated arbitrary code execution on master servers + + + jenkins + 1.587 + + + jenkins-lts + 1.580.1 + + + + +

Kohsuke Kawaguchi from Jenkins team reports:

+
Historically, Jenkins master and slaves behaved as if + they altogether form a single distributed process. This + means a slave can ask a master to do just about anything + within the confinement of the operating system, such as + accessing files on the master or trigger other jobs on + Jenkins.
+
This has increasingly become problematic, as larger + enterprise deployments have developed more sophisticated + trust separation model, where the administators of a master + might take slaves owned by other teams. In such an + environment, slaves are less trusted than the master. + Yet the "single distributed process" assumption was not + communicated well to the users, resulting in vulnerabilities + in some deployments.
+
SECURITY-144 (CVE-2014-3665) introduces a new subsystem + to address this problem. This feature is off by default for + compatibility reasons. See Wiki for more details, who should + turn this on, and implications.
+
CVE-2014-3566 is rated high. It only affects + installations that accept slaves from less trusted + computers, but this will allow an owner of of such slave to + mount a remote code execution attack on Jenkins.
+

+ + + + CVE-2014-3665 + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 + https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control + http://www.cloudbees.com/jenkins-security-advisory-2014-10-30 + + + 2014-10-30 + 2014-10-31 + + + libssh -- PRNG state reuse on forking servers