Bug 982014 (CVE-2016-5104) - VUL-0: CVE-2016-5104: libimobiledevice: Sockets listening on INADDR_ANY
Summary: VUL-0: CVE-2016-5104: libimobiledevice: Sockets listening on INADDR_ANY
Status: RESOLVED FIXED
Alias: CVE-2016-5104
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/169494/
Whiteboard: CVSSv2:RedHat:CVE-2016-5104:4.3:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-27 12:45 UTC by Alexander Bergmann
Modified: 2016-08-30 10:20 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2016-05-27 12:45:01 UTC 
rh#1339988

It was found that libimobiledevice and libusbmuxd libraries accidentally bound a listening IPv4 TCP socket to INADDR_ANY instead of INADDR_LOOPBACK.

Upstream patches:
libusbmuxd: https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991d0aed61ce6482614196

libimobiledevice: https://github.com/libimobiledevice/libimobiledevice/commit/df1f5c4d70d0c19ad40072f5246ca457e7f9849e

CVE request:
http://seclists.org/oss-sec/2016/q2/410

CVE assignment:
http://seclists.org/oss-sec/2016/q2/415

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1339988
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5104
http://seclists.org/oss-sec/2016/q2/415
Comment 1 Dominique Leuenberger 2016-05-27 12:56:24 UTC 
I'll prepare fixes for
* openSUSE 13.2
* openSUSE Leap 42.1
* openSUSE Tumbleweed
Comment 2 Dominique Leuenberger 2016-05-27 13:20:21 UTC 
open openSUSE 13.2 and Leap 42.1:

Request: #398365

  maintenance_incident: home:dimstar:boo982014/libimobiledevice.openSUSE_13.2_Update@0b1c1510121aba561a14b0d98823e4ca -> openSUSE:Maintenance (release in openSUSE:13.2:Update)
  maintenance_incident: home:dimstar:boo982014/libimobiledevice.openSUSE_Leap_42.1_Update@93eb0a1bc629d19f7498d50f22579f8a -> openSUSE:Maintenance (release in openSUSE:Leap:42.1:Update)
  maintenance_incident: home:dimstar:boo982014/libusbmuxd.openSUSE_13.2_Update@0e266636b87a659851f98e7021ca17ea -> openSUSE:Maintenance (release in openSUSE:13.2:Update)
  maintenance_incident: home:dimstar:boo982014/libusbmuxd.openSUSE_Leap_42.1_Update@1545d56dd624beda48af977b31da9054 -> openSUSE:Maintenance (release in openSUSE:Leap:42.1:Update)

for Tumbleweed (via devel prj)
SR#398366 for libimobiledevice
SR#398367 for libusbmuxd

=> handing over to security for release and patch info
Comment 5 Marcus Meissner 2016-06-08 10:51:43 UTC 
(remote code execution)
Comment 6 Swamp Workflow Management 2016-06-08 13:08:16 UTC 
openSUSE-SU-2016:1526-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 982014
CVE References: CVE-2016-5104
Sources used:
openSUSE Leap 42.1 (src):    libimobiledevice-1.2.0-6.2, libusbmuxd-1.0.10-4.1
openSUSE 13.2 (src):    libimobiledevice-1.1.6-2.3.1, libusbmuxd-1.0.9-2.3.1
Comment 8 Marcus Meissner 2016-06-21 09:16:40 UTC 
sle11 is not using usbmuxd.

all released.
Comment 9 Swamp Workflow Management 2016-06-21 11:21:39 UTC 
SUSE-SU-2016:1639-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 982014
CVE References: CVE-2016-5104
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    libimobiledevice-1.1.5-6.1
SUSE Linux Enterprise Workstation Extension 12 (src):    libimobiledevice-1.1.5-6.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libimobiledevice-1.1.5-6.1, usbmuxd-1.0.8-12.1
SUSE Linux Enterprise Software Development Kit 12 (src):    libimobiledevice-1.1.5-6.1, usbmuxd-1.0.8-12.1
SUSE Linux Enterprise Server 12-SP1 (src):    libimobiledevice-1.1.5-6.1, usbmuxd-1.0.8-12.1
SUSE Linux Enterprise Server 12 (src):    libimobiledevice-1.1.5-6.1, usbmuxd-1.0.8-12.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libimobiledevice-1.1.5-6.1, usbmuxd-1.0.8-12.1
SUSE Linux Enterprise Desktop 12 (src):    libimobiledevice-1.1.5-6.1, usbmuxd-1.0.8-12.1