Amazon Linux AMI : golang (ALAS-2017-918)

critical Nessus Plugin ID 104392

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

Arbitrary code execution during go get or go get -d :

Go before 1.8.4 and 1.9.x before 1.9.1 allows 'go get' remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, 'go get' can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running 'go get.' (CVE-2017-15041)

smtp.PlainAuth susceptible to man-in-the-middle password harvesting

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password. (CVE-2017-15042)

Solution

Run 'yum update golang' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2017-918.html

Plugin Details

Severity: Critical

ID: 104392

File Name: ala_ALAS-2017-918.nasl

Version: 3.3

Type: local

Agent: unix

Published: 11/6/2017

Updated: 4/18/2018

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:golang, p-cpe:/a:amazon:linux:golang-bin, p-cpe:/a:amazon:linux:golang-docs, p-cpe:/a:amazon:linux:golang-misc, p-cpe:/a:amazon:linux:golang-race, p-cpe:/a:amazon:linux:golang-src, p-cpe:/a:amazon:linux:golang-tests, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Patch Publication Date: 11/2/2017

Reference Information

CVE: CVE-2017-15041, CVE-2017-15042

ALAS: 2017-918