Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in     Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for     'roles' used for access control within the database, including the special case '_admin' role, that     denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used     to give non-admin users access to arbitrary shell commands on the server as the database system user. The     JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second     one will be used for authorising the document write, but the first 'roles' key is used for subsequent     authorization for the newly created user. By design, users can not assign themselves roles. The     vulnerability allows non-admin users to give themselves admin privileges. (CVE-2017-12635)

Note that Nessus relies on the presence of the package as reported by the vendor.

Apache CouchDB PMC reports :

Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases.

CVE-2017-12635 Prevent non-admin users to give themselves admin privileges.

CVE-2017-12636 Blacklist some configuration options to prevent execution of arbitrary shell commands as the CouchDB user

For Debian 7 'Wheezy', these problems have been fixed in version 1.2.0-5+deb7u1.

We recommend that you upgrade your couchdb packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CouchDB ver. 1.7.1

  - Fixed CVE-2017-12635

  - Fixed CVE-2017-12636

  - Switched to eunit for testing

  - Erlang 20 compatible

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201711-16 (CouchDB: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in CouchDB. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary shell commands or escalate       privileges.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
260684	Linux Distros Unpatched Vulnerability : CVE-2017-12635	Nessus	Misc.	critical
111018	FreeBSD : couchdb -- multiple vulnerabilities (1e54d140-8493-11e8-a795-0028f8d09152)	Nessus	FreeBSD Local Security Checks	critical
106208	Debian DLA-1252-1 : couchdb security update	Nessus	Debian Local Security Checks	critical
105943	Fedora 27 : couchdb / erlang-jiffy (2017-a20d92573b)	Nessus	Fedora Local Security Checks	critical
104697	GLSA-201711-16 : CouchDB: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2017-12635

critical

Tenable Plugins

critical

critical

critical

critical

critical