Pexip security bulletins

Resolved minor issues: CVE-2020-36516, CVE-2021-32292, CVE-2022-20572, CVE-2022-3107, CVE-2022-3435, CVE-2022-3524, CVE-2022-3543, CVE-2022-3623, CVE-2022-3707, CVE-2022-4378, CVE-2022-48554, CVE-2023-0179, CVE-2023-0386, CVE-2023-0458, CVE-2023-0459, CVE-2023-0461, CVE-2023-0465, CVE-2023-0466, CVE-2023-0590, CVE-2023-1095, CVE-2023-1206, CVE-2023-1249, CVE-2023-1252, CVE-2023-1255, CVE-2023-1998, CVE-2023-20588, CVE-2023-20900, CVE-2023-22998, CVE-2023-23006, CVE-2023-23931, CVE-2023-2650, CVE-2023-2975, CVE-2023-31130, CVE-2023-31248, CVE-2023-3138, CVE-2023-32233, CVE-2023-3390, CVE-2023-3446, CVE-2023-36053, CVE-2023-3609, CVE-2023-3610, CVE-2023-3611, CVE-2023-3772, CVE-2023-3773, CVE-2023-3776, CVE-2023-38039, CVE-2023-3817, CVE-2023-38633, CVE-2023-39318, CVE-2023-39319, CVE-2023-4004, CVE-2023-40217, CVE-2023-4128, CVE-2023-4147, CVE-2023-4569, CVE-2023-4622, CVE-2023-4911

A vulnerability exists in .NET when processing malicious X.509 client certificates that may consume excessive CPU and lead to a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity 32.1

Cross-site scripting vulnerability in legacy webapp ("Webapp1") when using preconfigured links.

CVSS3.1 base score: 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

Discussion: An attacker may achieve cross-site scripting by convincing a user to activate a crafted preconfigured link using the legacy Infinity Connect web app ("Webapp1").

• Since Infinity v26, the default configuration enables the Content-Security-Policy response header, allowing the client to enforce the domains from which script contents may be fetched. These include the wildcard domains *.microsoft.com and *.office.com. An attacker able to control or host a script under these domains may cause the application to execute attacker-controlled code.
• In Infinity v25, the Content-Security-Policy response header is disabled by default, but may be enabled on this software version via the security wizard. The Content-Security-Policy response header will include the wildcard domains *.microsoft.com and *.office.com. An attacker able to control or host a script under these domains may cause the application to execute attacker-controlled code.
• In Infinity v18-24, the Content-Security-Policy response header is disabled by default, but may be enabled in these software versions via the security wizard. There are no wildcard domains present in the "script-src" section of the Content-Security-Policy response header in these versions.
• In Infinity before v18, there is no support for the Content-Security-Policy response header and thus no domain-based restrictions on scripts are available.

Mitigation:

• On Infinity v31, access to the webapp can be disabled via the Administrator interface (Web App > Web App Paths) by deselecting the Enabled option for webapp1.
• Infinity v26 onwards allow the Administrator to configure the enabled state and contents of the Content-Security-Policy header via the Administrator interface (Platform > Global Settings > Security). Ensure that the Content-Security-Policy header is enabled and review local modifications to determine if further wildcard domains have been added (and, if they have, consider whether a non-wildcard domain could be used instead). Where the Pexip Scheduling Outlook Add-In is not in use, both *.microsoft.com and *.office.com may safely be removed from the Content-Security-Policy.
• For Infinity v18-25, ensure that the Enable Content-Security-Policy for Conferencing Nodes setting in the security wizard has been configured to yes (it defaults to no in these software versions). Note, however, that the contents of the Content-Security-Policy response header are not configurable on these software versions.
• For Infinity v5-17, there is no mitigation.

Resolution: Upgrade to Pexip Infinity 32.0. For deployments running Infinity v30.x and v31.x, contact your authorized Pexip support representative for a software bundle fix.

Credit: This issue was responsibly disclosed by https://github.com/40826d.

Resolved minor issues: CVE-2022-3515, CVE-2022-3736, CVE-2022-3924, CVE-2022-4203, CVE-2022-4304, CVE-2022-32221, CVE-2022-38725, CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-1255, CVE-2023-2650, CVE-2023-23916, CVE-2023-26463, CVE-2023-27537, CVE-2023-28484, CVE-2023-29469

Insufficient input validation in the RTCP implementation allows a remote attacker to trigger a software abort resulting in a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Discussion: A crafted RTCP payload allows a remote attacker to trigger a software abort resulting in a denial of service.

Mitigation: None

Resolution: Upgrade to Pexip Infinity 31.2

Insufficient input validation in the signalling implementation(s) allows a malicious attacker to trigger a software abort resulting in a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to v31.2

The sudoedit command mishandles extra arguments, allowing a local attacker to append arbitrary entries to the list of files to process, leading to privilege escalation.

CVSS 3.1 base score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Mitigation: The sole non-system user account ("admin") is explicitly given privileges to allow escalation via sudo. Therefore, this vulnerability is only relevant as a mechanism to potentially escalate privileges after exploiting some other vulnerability to gain access to the system as an unprivileged user.

Resolution: Upgrade to Pexip Infinity v31.1

A type confusion vulnerability in the OpenSSL cryptography library allows an attacker to read memory contents or cause a software abort when CRL checking is enabled.

CVSS 3.1 base score: 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)

Mitigation: No software shipped as part of Pexip Infinity is configured to use CRLs (as Infinity uses OCSP instead), therefore this vulnerability is only relevant if unsupported configuration or software changes have been made.

Resolution: Upgrade to Pexip Infinity v31.1

High

Resource mismanagement in the OpenSSL cryptography library allows an attacker to trigger a use after free when processing ASN.1 data leading to a software abort.

CVSS 3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity v31.1

High

The strongSwan IPsec implementation allows remote attackers to cause a denial of service.

CVSS 3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: Strongswan is configured to only permit tunnel establishment by other nodes in the deployment. Further, ISAKMP traffic is restricted by the firewall such that traffic from source addresses outside the deployment is rejected.

Resolution: Upgrade to Pexip Infinity v31.1

High

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

CVSS 3.1 base score: 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity v31.1

High

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: Components using this library enforce payload size limits before passing input data into libxml2. These size limits are significantly below that needed to be able to exploit this issue.

Resolution: Upgrade to Pexip Infinity v31.1

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection, potentially allowing an attacker to execute arbitrary commands with the privileges of the script.

CVSS 3.1 base score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Mitigation: The c_rehash script is used during system upgrade when updating the built-in Certificate Authorities. The updated Certificate Authorities and script usage are part of the upgrade archive which is signed using keys known only to Pexip and thus ensures that the input data is trusted.

Resolution: Upgrade to Pexip Infinity v31.1

Critical

A parsing vulnerability for the MessageSet type in the ProtocolBuffers implementation allows an attacker to cause a software abort.

CVSS 3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: ProtocolBuffers are used when communicating with Google Meet. Other service types are not affected.

Resolution: Upgrade to Pexip Infinity v31.1

High

An out-of-bounds read vulnerability in the PCRE2 library allows an attacker to cause a software abort.

CVSS 3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity v31.1

High

An out-of-bounds read vulnerability in the PCRE2 library allows an attacker to cause a software abort.

CVSS 3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity v31.1

High

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection, potentially allowing an attacker to execute arbitrary commands with the privileges of the script.

CVSS 3.1 base score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Mitigation: The c_rehash script is used during system upgrade when updating the built-in Certificate Authorities. The updated Certificate Authorities and script usage are part of the upgrade archive which is signed using keys known only to Pexip and thus ensures that the input data is trusted.

Resolution: Upgrade to Pexip Infinity v31.1

Resolved minor issues: CVE-2022-43680, CVE-2022-43638, CVE-2022-42898, CVE-2022-42703, CVE-2022-42010, CVE-2022-41323, CVE-2022-40476, CVE-2022-39190, CVE-2022-39188, CVE-2022-38178, CVE-2022-38177, CVE-2022-36946, CVE-2022-36879, CVE-2022-36359, CVE-2022-35252, CVE-2022-34495, CVE-2022-34494, CVE-2022-32296, CVE-2022-32206, CVE-2022-32205, CVE-2022-32148, CVE-2022-28347, CVE-2022-28346, CVE-2022-27776, CVE-2022-27774, CVE-2022-26373, CVE-2022-22576, CVE-2022-20368, CVE-2022-4304, CVE-2022-3775, CVE-2022-3629, CVE-2022-3625, CVE-2022-3586, CVE-2022-3515, CVE-2022-3080, CVE-2022-3028, CVE-2022-2959, CVE-2022-2938, CVE-2022-2929, CVE-2022-2928, CVE-2022-2905, CVE-2022-2795, CVE-2022-2602, CVE-2022-2601, CVE-2022-2588, CVE-2022-2586, CVE-2022-2585, CVE-2022-1962, CVE-2022-1705, CVE-2022-1508, CVE-2022-1184, CVE-2021-46829, CVE-2021-46828, CVE-2021-33655, CVE-2021-29648, CVE-2021-26401, CVE-2021-4150, CVE-2021-4023, CVE-2021-3759, CVE-2021-3669

Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

Unknown

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

High

Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

Resolved minor issue: CVE-2022-1867

Missing authenticity checks in application provisioning allow an attacker to cause the application to run untrusted code.

CVSS3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect app 1.8.0

Credit: This issue was responsibly disclosed by The UK's National Cyber Security Centre (NCSC)

Missing checks in certificate allow list matching allow a remote attacker to compromise a TLS connection, extracting data and potentially causing remote code execution.

CVSS3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity Connect 1.8.0

Credit: This issue was responsibly disclosed by The UK's National Cyber Security Centre (NCSC)

The Pexip VMR self-service portal before v3 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof fake instances by leveraging these keys.

CVSS 3.1 base score: 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: Manually remove and regenerate the SSH host keys on each VMR Portal instance.

Resolution: Upgrade to VMR portal v3.