CVE-2017-10807

JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.

This update for the SUSE Manager Server 3.1 provides several fixes and improvements.

The following security issues have been fixed:

jabberd:

• Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807)

spacewalk-java:

• Do not allow XSS as Organization name. (bsc#1048968, CVE-2017-7538)

Additionally, the following non-security issues have been fixed:

cobbler:

• Fix missing arguments and location for Xen. (bsc#1048183)

jabberd:

• Fix memory leak in pgsql storage driver.
• Fix two double-frees caused by dangling pointers.
• wss:// (WebSocket over SSL) support in c2s.
• Allow BareJID S10N packets.
• SQLite postconnect SQL support.
• Support WebSocket fragmented packets.
• Module to verify users using e-mail.
• Use OpenSSL functions for base64 en/decoding when available.
• Option to dump packet-filter matched packets to file.
• bcrypt support for PostgreSQL and MySQL storage.
• Option to set authreg module per realm.
• WebSocket C2S SX plugin.
• Support for RSA/DH/ECDH key agreement.
• For a detailed description of all fixes, please refer to the changelog.

osad:

• Reduce maximal size of osad log before rotating.
• Perform osad restart in posttrans. (bsc#1039913)

salt-netapi-client:

• Fix date format for Schedule.
• Fix sending kwarg in payload in RunnerCall.
• Better error handling in Runner and Wheel calls.
• Increase the default SOCKET_TIMEOUT to 20 seconds.

smdba:

• Add support for postgresql96. (bsc#1045152)

spacecmd:

• Configchannel export binary flag to json. (bsc#1044719)

spacewalk-backend:

• Make master_label static to keep its value when retrying. (bsc#1038321)
• Adapt for the new gpgcheck flag for the channels.

spacewalk-branding:

• Fix overlapping of elements. (bsc#1031143)
• Fix overlapping text narrow window. (bsc#1009118)
• Fix formulas action buttons position. (bsc#1047513)
• Fix broken link. (bsc#1033999)
• Alphabar: Change title to 'Select first character'. (bsc#1042199)

spacewalk-certs-tools:

• Improve text for bootstrap. (bsc#1032324)

spacewalk-java:

• Don't add default channel if AK is not valid. (bsc#1047656)
• Add 'Enable GPG check' function for channels.
• No legend icon for Activity Ocurring. (bsc#1051719)
• Implement API call for bootstrapping systems.
• Fix product ids reported for SUSE Manager Server to the subscription matcher.
• Fix adding products when assigning channels. (bsc#1049664)
• Set default memory size for SLES 12 installations to 1024MB. (bsc#1047707)
• Enable remote-command for Salt clients in SSM. (bsc#1050385)
• Add missing help icons/links. (bsc#1049425)
• Fix invalid help links. (bsc#1049425)
• Fix wrong openscap xid. (bsc#1030898)
• Fix overlapping text narrow window. (bsc#1009118)
• Fixes alignment on the orgdetails. (bsc#1017513)
• Fix text for activation key buttons. (bsc#1042975)
• Correctly set, check and cut textarea maxlength. (bsc#1043430)
• MinionActionExecutor: Raise skip timeout. (bsc#1046865)
• Update channels.xml with OpenStack Cloud Continuous Delivery 6. (bsc#1039458)
• Do not create VirtualInstance duplicates for the same 'uuid'.
• Add taskomatic task to cleanup duplicated uuids for same system id.
• Handle possible wrong UUIDs on SLE11 minions. (bsc#1046218)
• Removed duplicate overview menu item. (bsc#1045981)
• Enable act-key name empty on creation. (bsc#1032350)
• Fix NPE when there's not udev results. (bsc#1042552)
• Alphabar: Change title to 'Select first character'. (bsc#1042199)
• Duplicate Systems: Correct language not to mention 'profiles'. (bsc#1035728)
• Fix list filters to work with URL special characters. (bsc#1042846)
• Use getActive() instead of isActive() for JavaBeans compliance. (bsc#1043143)
• Fix hide non-org event details. (bsc#1039579)

spacewalk-search:

• Remove executable bit from service files. (bsc#1051518)

spacewalk-utils:

• Don't show password on input in spacewalk-manage-channel-lifecycle. (bsc#1043795)

spacewalk-web:

• Fix overlapping of elements. (bsc#1031143)
• Fix formulas action buttons…

This update for SUSE Manager Proxy 3.1 provides several fixes and improvements:

The following security issues have been fixed:

jabberd:

• Fix offered SASL mechanism check. (bsc#1047282, CVE-2017-10807)

Additionally, the following non-security issues have been fixed:

jabberd:

• Fix memory leak in pgsql storage driver.
• Fix two double-frees caused by dangling pointers.
• wss:// (WebSocket over SSL) support in c2s.
• Allow BareJID S10N packets.
• SQLite postconnect SQL support.
• Support WebSocket fragmented packets.
• Module to verify users using e-mail.
• Use OpenSSL functions for base64 en/decoding when available.
• Option to dump packet-filter matched packets to file.
• bcrypt support for PostgreSQL and MySQL storage.
• Option to set authreg module per realm.
• WebSocket C2S SX plugin.
• Support for RSA/DH/ECDH key agreement.
• For a detailed description of all fixes, please refer to the changelog.

osad:

• Reduce maximal size of osad log before rotating.
• Perform osad restart in posttrans. (bsc#1039913)

spacewalk-backend:

• Make master_label static to keep its value when retrying. (bsc#1038321)
• Adapt for the new gpgcheck flag for the channels.

spacewalk-certs-tools:

• Improve text for bootstrap. (bsc#1032324)

spacewalk-proxy:

• Use query string in upstream HEAD requests. (bsc#1036260)

spacewalk-web:

• Fix overlapping of elements. (bsc#1031143)
• Fix formulas action buttons position. (bsc#1047513)
• Do not show old messages. (bsc#1043831)
• Add a dynamic counter of the remaining textarea length.
• Confirm if navigating away while bootstrapping.

spacewalksd:

• Fix permissions of PID files in spacewalksd. (bsc#1049936)

zypp-plugin-spacewalk:

• Fix setting pkg_gpgcheck.
• Make pkg_gpgcheck configurable.

How to apply this update:

1. Log in as root user to the SUSE Manager proxy.
2. Stop the proxy service: spacewalk-proxy stop
3. Apply the patch using either zypper patch or YaST Online Update.
4. Start the Spacewalk service: spacewalk-proxy start

This update for jabberd fixes the following issues:

• CVE-2017-10807: SASLANONYMOUS authentication method allowed anyone to authentication even if option was disabled (bsc#1047282)

It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. A remote attacker could possibly use this issue to bypass authentication.