Ubuntu Security Podcast

Latest Episodes:

Episode 93 Oct 23, 2020

Show notes

Overview This week we cover security updates for NTP, Brotli, Spice, the Linux kernel (including BleedingTooth) and a FreeType vulnerability which is being exploited in-the-wild, plus we talk about the NSAs report into the most exploited vulnerabilities as well as the release of Ubuntu 20.10 Groovy Gorilla. This week in Ubuntu Security Updates 74 unique CVEs addressed [USN-4559-1] Samba update [01:04] 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-1472 Follow up to USN-4510-1 for “ZeroLogon” - that updated changed default to enable secure channel - this one adds support for specifying per-machine insecure netlogon usage plus additional hardening to check for possible attacks from the client-specified challenge if have manually enabled insecure channel in configuration [USN-4563-1] NTP vulnerability [01:48] 2 CVEs addressed in Bionic (18.04 LTS) CVE-2019-8936 CVE-2018-7182 Fix for previous CVE-2018-7182 introduced a possible NULL ptr deref that could be triggered by a malicious client -> DoS [USN-4568-1] Brotli vulnerability [02:12] 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-8927 Compression library / tool from Google designed for text compression, especially for web fonts etc Buffer overflow due to an integer overflow when using the one-shot decompression option on attacker controlled data [USN-4570-1] urllib3 vulnerability [03:00] 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-26137 Possible CRLF injection if an attacker can control the request method used in a call to urllib3 - can specify additional parameters such as Host and Remainder after an injected CRLF to cause the request to misbehave [USN-4572-1, USN-4572-2] Spice vulnerability [03:41] 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-14355 Protocol for doing remote VM access - multiple buffer overflows in decoding of QUIC image compression algorithm - and this affected both the client and server side - DoS, RCE etc [USN-4576-1] Linux kernel vulnerabilities [04:36] 6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-25641 CVE-2020-25285 CVE-2020-16120 CVE-2020-14385 CVE-2020-14314 CVE-2020-16119 [USN-4577-1] Linux kernel vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS) CVE-2020-16120 CVE-2020-16119 [USN-4578-1] Linux kernel vulnerabilities 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2020-26088 CVE-2020-25212 CVE-2020-16120 CVE-2020-14314 CVE-2019-19448 CVE-2018-10322 CVE-2020-16119 [USN-4579-1] Linux kernel vulnerabilities 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS) CVE-2020-25285 CVE-2020-14314 CVE-2018-10322 CVE-2020-16119 [USN-4580-1] Linux kernel vulnerability 1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM) CVE-2020-16119 DCCP protocol mishandled reuse of sockets, leading to a UAF - since can be done by a local user could lead to root code execution, priv esc etc - was reported to Canonical and we worked with upstream kernel devs on resolving this etc [LSN-0072-1] Linux kernel vulnerability 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-16120 CVE-2020-16119 CVE-2020-14386 CVE-2020-12114 CVE-2020-11935 CVE-2020-11494 CVE-2020-0067 DCCP UAF AF_PACKET buffer overflow (Episode 90) Livepatched in the following kernels: Ubuntu 18.04 LTS aws - 72.1 generic - 72.1 lowlatency - 72.1 oem - 72.1 Ubuntu 20.04 LTS aws - 72.1 aws - 72.2 azure - 72.1 azure - 72.2 gcp - 72.1 gcp - 72.2 generic - 72.1 generic - 72.2 lowlatency - 72.1 lowlatency - 72.2 Ubuntu 16.04 LTS aws - 72.1 generic - 72.1 lowlatency - 72.1 Ubuntu 14.04 ESM generic - 72.1 lowlatency - 72.1 [USN-4591-1] Linux kernel vulnerabilities [06:20] 2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-12352 CVE-2020-12351 [USN-4592-1] Linux kernel vulnerabilities 3 CVEs addressed in Bionic (18.04 LTS) CVE-2020-24490 CVE-2020-12352 CVE-2020-12351 BleedingTooth vulnerability Announced by Intel, discovered by a security researcher at Google - not much heads up to distros, kernel team worked quickly to respin affected kernels (>= 4.8) over the weekend Originally was mention on twitter that Google were going to publish a blog post with more details but this got held back to give time for distros etc to patch [USN-4593-1] FreeType vulnerability [07:30] 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-15999 Integer overflow -> heap buffer overflow Reported by Google to Freetype upstream with the comment that it was being exploited in the wild The patch simply moves a check that was added originally to fix another CVE a few lines higher since it still provided the chance of an integer overflow -> heap buffer overflow Update released for Ubuntu within 16h of the original report to the upstream FreeType developers [USN-4558-1] libapreq2 vulnerabilities 1 CVEs addressed in Bionic (18.04 LTS) CVE-2019-12412 [USN-4557-1] Tomcat vulnerabilities 7 CVEs addressed in Xenial (16.04 LTS) CVE-2016-8735 CVE-2016-6816 CVE-2016-6797 CVE-2016-6796 CVE-2016-6794 CVE-2016-5018 CVE-2016-0762 [USN-4560-1] Gon gem vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2020-25739 [USN-4561-1] Rack vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS) CVE-2020-8184 CVE-2020-8161 [USN-4562-1] kramdown vulnerability 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-14001 [USN-4569-1] Yaws vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS) CVE-2020-24916 CVE-2020-24379 [USN-4571-1] rack-cors vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2019-18978 [USN-4564-1] Apache Tika vulnerabilities 2 CVEs addressed in Xenial (16.04 LTS) CVE-2020-1951 CVE-2020-1950 [USN-4565-1] OpenConnect vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2019-16239 [USN-4566-1] Cyrus IMAP Server vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS) CVE-2019-19783 CVE-2019-11356 [USN-4567-1] OpenDMARC vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2019-16378 [USN-4573-1] Vino vulnerabilities 7 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-14404 CVE-2020-14403 CVE-2020-14402 CVE-2020-14397 CVE-2019-15681 CVE-2018-7225 CVE-2014-6053 [USN-4574-1] libseccomp-golang vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2017-18367 [USN-4575-1] dom4j vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2020-10683 [USN-4581-1] Python vulnerability 1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2020-26116 [USN-4582-1] Vim vulnerabilities 2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2019-20807 CVE-2017-17087 [USN-4583-1] PHP vulnerabilities 2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-7070 CVE-2020-7069 [USN-4589-1] containerd vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2020-15157 [USN-4589-2] Docker vulnerability 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-15157 [USN-4585-1] Newsbeuter vulnerabilities 2 CVEs addressed in Xenial (16.04 LTS) CVE-2017-14500 CVE-2017-12904 [USN-4584-1] HtmlUnit vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2020-5529 [USN-4546-2] Firefox regressions Affecting Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) [USN-4590-1] Collabtive vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2015-0258 [USN-4586-1] PHP ImageMagick vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2019-11037 [USN-4594-1] Quassel vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS) CVE-2018-1000179 CVE-2018-1000178 [USN-4595-1] Grunt vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2020-7729 Goings on in Ubuntu Security Community NSA Report on 25 most exploited CVEs by Chinese State-Sponsored Actors [09:51] https://twitter.com/NSACyber/status/1318568065769132035 https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF Most apply to appliances (network gateway devices) or Windows Only 1 applies open source software for Linux CVE-2018-6789 - Exim 4.90.1 - CVE was public 7 February 2018, patched in affected Ubuntu releases 5 days later on 12 February 2018 oss-security posting claims ‘unsure of severity, an exploit is difficult’ The researcher which found it provided a very detailed write-up about the low-level details to exploit it on 6th March 2018 but without an actual PoC (although all details are there to reconstruct one) First public PoC seems to be on 2 May 2018 - there have been others since (exploitdb, github etc) So why does this one get exploited over others? Availability of multiple PoC? Have other distros not patched? Are there lots of installs that are from source and have never been updated? Lots of old docker images of various exim with lots of Pulls (although the most popular one was updated 9 days ago) Shows should always get your open source from a trusted, maintained downstream like Ubuntu Ubuntu 20.10 Groovy Gorilla Release [13:50] https://lists.ubuntu.com/archives/ubuntu-announce/2020-October/000263.html Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 92 Oct 02, 2020

Show notes

Overview It’s CVE bankruptcy! With a deluge of CVEs to cover from the last 2 weeks, we take a particular look at the ZeroLogon vulnerability in Samba this week, plus Alex covers the AppArmor 3 release and some recent / upcoming webinars hosted by the Ubuntu Security team. This week in Ubuntu Security Updates 121 unique CVEs addressed [USN-4510-1, USN-4510-2] Samba vulnerability 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2020-1472 “ZeroLogon” Would allow an attacker who already can communicate with the domain controller to reset it’s password and so then take control of the DC and obtain the domain admin’s credentials Flaw in the NetLogon protocol would allow the attacker to impersonate any computer in the domain, even the DC itself, and execute calls on that computer’s behalf This flaw was in the cryptographic authentication scheme employed by the NetLogon protocol Samba also implements this protocol - and so contained the same flaw In both cases (Window AD vs Samba) there is an option to use a more secure authentication mechanism - for older Ubuntu releases like Trusty, Xenial and Bionic the default configuration as specified by upstream Samba did not enforce the use of this bu default So the fix is a simple configuration change to enable this by default This is done by patching Samba directly (rather than trying to say update everyone’s deployed /etc/samba.conf or similar) - which still allows a local admin to turn this off if they so desire (although this is definitely not recommended) One example of how Ubuntu tries to be secure by default - when known better security configuration options become available we try and enable them (whilst weighing up the likelihood of breaking existing installs - we try very hard not to do this) Similarly we have done the same for the various spec exec mitigations - almost all default to on even at the expense of a performance hit in that case [USN-4504-1] OpenSSL vulnerabilities 4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2019-1563 CVE-2019-1551 CVE-2019-1547 CVE-2020-1968 [USN-4505-1] PHPMailer vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2020-13625 [USN-4506-1] MCabber vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2016-9928 [USN-4507-1] ncmpc vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2018-9240 [USN-4508-1] StoreBackup vulnerability 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-7040 [USN-4509-1] Perl DBI module vulnerabilities 2 CVEs addressed in Trusty ESM (14.04 ESM) CVE-2014-10401 CVE-2013-7490 [USN-4511-1] QEMU vulnerability 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-14364 [USN-4512-1] util-linux vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2018-7738 [USN-4513-1] apng2gif vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2017-6960 [USN-4514-1] libproxy vulnerability 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-25219 [USN-4515-1] Pure-FTPd vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2020-9274 [USN-4516-1] GnuPG vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2019-14855 USN-4518-1] xawtv vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2020-13696 [USN-4519-1] PulseAudio vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2020-15710 [USN-4520-1] Exim SpamAssassin vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2019-19920 [USN-4521-1] pam_tacplus vulnerability 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-13881 [USN-4522-1] noVNC vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2017-18635 [USN-4523-1] LibOFX vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2019-9656 [USN-4524-1] TNEF vulnerabilities 1 CVEs addressed in Xenial (16.04 LTS) CVE-2019-18849 [USN-4525-1] Linux kernel vulnerabilities 5 CVEs addressed in Focal (20.04 LTS) CVE-2020-25212 CVE-2020-16166 CVE-2020-12888 CVE-2019-19054 CVE-2019-18808 [USN-4526-1] Linux kernel vulnerabilities 10 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2020-16166 CVE-2020-14356 CVE-2020-12888 CVE-2019-9445 CVE-2019-19074 CVE-2019-19073 CVE-2019-19067 CVE-2019-19061 CVE-2019-19054 CVE-2019-18808 [USN-4527-1] Linux kernel vulnerabilities 8 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS) CVE-2020-25212 CVE-2020-0067 CVE-2019-9453 CVE-2019-9445 CVE-2019-20811 CVE-2019-19074 CVE-2019-19073 CVE-2019-19054 [USN-4528-1] Ceph vulnerabilities 3 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2020-1760 CVE-2020-12059 CVE-2020-10753 [USN-4529-1] FreeImage vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS) CVE-2019-12213 CVE-2019-12211 [USN-4531-1] BusyBox vulnerability 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2018-1000500 [USN-4530-1] Debian-LAN vulnerabilities 1 CVEs addressed in Bionic (18.04 LTS) CVE-2019-3467 [USN-4532-1] Netty vulnerabilities 3 CVEs addressed in Bionic (18.04 LTS) CVE-2019-20445 CVE-2019-20444 CVE-2019-16869 [USN-4533-1] LTSP Display Manager vulnerabilities 1 CVEs addressed in Focal (20.04 LTS) CVE-2019-20373 [USN-4534-1] Perl DBI module vulnerability 1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2019-20919 [USN-4535-1] RDFLib vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2019-7653 [USN-4537-1] Aptdaemon vulnerability 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-15703 [USN-4538-1] PackageKit vulnerabilities 2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-16122 CVE-2020-16121 [USN-4536-1] SPIP vulnerabilities 7 CVEs addressed in Bionic (18.04 LTS) CVE-2019-16393 CVE-2019-19830 CVE-2017-15736 CVE-2019-16391 CVE-2019-11071 CVE-2019-16394 CVE-2019-16392 [USN-4539-1] AWL vulnerability 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-11728 [USN-4540-1] atftpd vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS) CVE-2019-11366 CVE-2019-11365 [USN-4542-1] MiniUPnPd vulnerabilities 5 CVEs addressed in Xenial (16.04 LTS) CVE-2019-12111 CVE-2019-12110 CVE-2019-12109 CVE-2019-12108 CVE-2019-12107 [USN-4543-1] Sanitize vulnerability 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-4054 [USN-4541-1] Gnuplot vulnerabilities 3 CVEs addressed in Xenial (16.04 LTS) CVE-2018-19492 CVE-2018-19491 CVE-2018-19490 [USN-4545-1] libquicktime vulnerabilities 7 CVEs addressed in Xenial (16.04 LTS) CVE-2017-9125 CVE-2017-9128 CVE-2017-9127 CVE-2017-9126 CVE-2017-9124 CVE-2017-9123 CVE-2017-9122 [USN-4546-1] Firefox vulnerabilities 6 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-15678 CVE-2020-15677 CVE-2020-15676 CVE-2020-15675 CVE-2020-15674 CVE-2020-15673 [USN-3968-3] Sudo vulnerabilities 2 CVEs addressed in Trusty ESM (14.04 ESM) CVE-2016-7032 CVE-2016-7076 [USN-4549-1] ImageMagick vulnerabilities 2 CVEs addressed in Focal (20.04 LTS) CVE-2019-19949 CVE-2019-19948 [USN-4548-1] libuv vulnerability 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-8252 [USN-4547-1] iTALC vulnerabilities 12 CVEs addressed in Bionic (18.04 LTS) CVE-2018-7225 CVE-2018-20750 CVE-2018-20749 CVE-2018-20748 CVE-2018-20024 CVE-2018-20023 CVE-2018-20022 CVE-2018-20021 CVE-2018-20020 CVE-2018-20019 CVE-2018-15127 CVE-2019-15681 [USN-4553-1] Teeworlds vulnerability 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-12066 [USN-4552-1] Pam-python vulnerability 1 CVEs addressed in Bionic (18.04 LTS) CVE-2019-16729 [USN-4550-1] DPDK vulnerabilities 5 CVEs addressed in Focal (20.04 LTS) CVE-2020-14378 CVE-2020-14377 CVE-2020-14376 CVE-2020-14375 CVE-2020-14374 [USN-4551-1] Squid vulnerabilities 4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2020-24606 CVE-2020-15811 CVE-2020-15810 CVE-2020-15049 [USN-4554-1] libPGF vulnerability 1 CVEs addressed in Xenial (16.04 LTS) CVE-2015-6673 [USN-4547-2] SSVNC vulnerabilities 5 CVEs addressed in Xenial (16.04 LTS) CVE-2018-20024 CVE-2018-2024 CVE-2018-20022 CVE-2018-20021 CVE-2018-20020 [USN-4556-1] netqmail vulnerabilities 5 CVEs addressed in Focal (20.04 LTS) CVE-2020-3812 CVE-2020-3811 CVE-2005-1515 CVE-2005-1514 CVE-2005-1513 Goings on in Ubuntu Security Community AppArmor 3.0 Release https://gitlab.com/apparmor/apparmor/-/releases/v3.0.0 https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0 Ubuntu Security Related Webinars FIPS certification and CIS compliance with Ubuntu Webinar <2020-10-01 Thu> More on the Ubuntu FIPS certification for cryptographic modules in Ubuntu 18.04 LTS and 16.04 LTS and the Ubuntu FIPS public cloud images The difference between FIPS certified and FIPS compliant modules More on compliance benchmark documentation for Ubuntu CIS compliance How to quickly harden Ubuntu systems and easily view which rules your systems are not compliant with using the CIS automation tooling from Canonical [demo] Presented by Vineetha Kamatha (Security Engineering Manager), Shaun Murphy (Public Cloud Sr Product Manager) & Lech Sandecki (Product Manager) https://www.brighttalk.com/webcast/6793/432536/fips-certification-and-cis-compliance-with-ubuntu Best Practices for Securing Open Source Webinar <2020-10-08 Thu> https://www.brighttalk.com/webcast/6793/440071 Presented by me :) Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 91 Sep 18, 2020

Show notes

Overview

This week we look at security updates for GUPnP, OpenJPEG, bsdiff and more.

This week in Ubuntu Security Updates

24 unique CVEs addressed

[USN-4488-2] X.Org X Server vulnerabilities [00:31]

5 CVEs addressed in Trusty ESM (14.04 ESM)
Episode 90

[LSN-0071-1] Linux kernel vulnerability [00:50]

1 CVEs addressed in Bionic (18.04 LTS)
- CVE-2020-14386
Episode 90 (AF_PACKET OOB write - crash / code exec)
Also affects Focal (20.04 LTS) but livepatch is still being prepared

[USN-4494-1] GUPnP vulnerability [01:29]

1 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-12695
GNOME UPnP impl, used by Rygel for media sharing on GNOME (standard Ubuntu) desktop and many other applications
Callstranger Vulnerability - vuln in UPnP protocol - callback header in UPnP SUBSCRIBE can contain arbitrary delivery URL - so this could be on a different network segment than the event subscription URL - so you can SUBSCRIBE to events and supply one or more URLs for delivery of the messages. Can then make this point anywhere and so can get the device to send HTTP traffic to any arbitrary destination - and so can be used for data exfil or DDoS attacks etc. Fixed to check the destination host is either a link-local address or the address mask matches - either way, check is on the same network segment.

[USN-4495-1] Apache Log4j vulnerability [03:21]

1 CVEs addressed in Bionic (18.04 LTS)
- CVE-2019-17571
Failed to properly deserialise data - so if is listening to untrusted log data from the network could be exploited to run arbitrary code

[USN-4496-1] Apache XML-RPC vulnerability [03:42]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
- CVE-2019-17570
Similarly failed to properly deserialize data - a malicious XML-RPC server could cause code execution on the client as a result

[USN-4497-1] OpenJPEG vulnerabilities [03:58]

7 CVEs addressed in Xenial (16.04 LTS)
Usual mix of memory safety issues in image handling libraries written in C - DoS, RCE etc via crafted image data

[USN-4499-1] MilkyTracker vulnerabilities [04:27]

3 CVEs addressed in Xenial (16.04 LTS)
Failed to properly validate files - 2 different heap and 1 stack based buffer overflows - RCE if loading untrusted files

[USN-4498-1] Loofah vulnerability [04:52]

1 CVEs addressed in Xenial (16.04 LTS)
- CVE-2019-15587
ruby module for manipulation and transformation of HTML/XML etc
Possible XSS - failed to sanitize JS when handling crafted SVG

[USN-4500-1] bsdiff vulnerabilities [05:16]

1 CVEs addressed in Xenial (16.04 LTS)
- CVE-2014-9862
(Oldest CVE of the week!)
Failed to properly validate input patch file -> integer overflow -> heap based buffer overflow -> code exec / DoS

[USN-4501-1] LuaJIT vulnerability [05:40]

1 CVEs addressed in Xenial (16.04 LTS)
- CVE-2020-15890
OOB read -> crash / info leak

[USN-4502-1] websocket-extensions vulnerability [05:49]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-7663
ruby websockets extension - used regex with backtracking to properly parse headers, could be sent crafted input which is very computationally intensive to parse as a result -> CPU based DoS

[USN-4503-1] Perl DBI module vulnerability [06:21]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS)
- CVE-2020-14392
Perl DB interface - underlying code would potentially allocate the stack and hence result in invalid pointers to object that were previously on the stack - could be manipulated by a remote user to result in memory corruption etc -> crash

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 90 Sep 11, 2020

Show notes

Overview

This week we look at security updates for the X server, the Linux kernel and GnuTLS plus we preview the upcoming AppArmor3 release that is slated for Ubuntu 20.10 (Groovy Gorilla).

This week in Ubuntu Security Updates

20 unique CVEs addressed

[USN-4487-1, USN-4487-2] libx11 vulnerabilities [00:58]

2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-14363
- CVE-2020-14344
2 privilege escalation attacks
- integer overflow -> double free -> memory corruption
- integer overflow -> heap buffer overflow
- privilege escalation may be possible since in both cases could cause arbitrary code exec with a binary that is using libX11 and running with root privileges (setuid / sudo etc) - this is why we often advise don’t run graphical applications via sudo etc

[USN-4488-1, USN-4490-1] X.Org X Server vulnerabilities [02:29]

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Various memory corruption vulnerabilities all discovered by Jan-Niklas Sohn - on some older releases (xenial and earlier) X server runs as root

[USN-4449-2] Apport vulnerabilities [03:28]

3 CVEs addressed in Trusty ESM (14.04 ESM)
Episode 85

[USN-4474-2] Firefox regressions [03:38]

8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Episode 89
80.0.1 - upstream release to fix regressions in 80.0 release -> crashes on GPU resets, WebGL rendering issues, performance issue in processing CA certs &c

[USN-4489-1] Linux kernel vulnerability [04:09]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-14386
AF_PACKET (layer 2) socket did not perform bounds checks in some places - requires CAP_NET_RAW or root - BUT can be root in a user namespace and these are enabled by default in Ubuntu and other Linux distros -> can disable by sysctl `kernel.unprivileged_userns_clone=0`

[USN-4491-1] GnuTLS vulnerability [06:01]

1 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-24659
Malicious server can trigger a NULL ptr deref in client during TLS 1.3 negotiation - DoS

Goings on in Ubuntu Security Community

AppArmor3 slated for Ubuntu 20.10 [06:32]

Beta version of AppArmor3 is being prepared for Ubuntu 20.10 Groovy Gorilla - should land in -proposed next week and then main soon after
Provides ABI feature pinning - so upgrading to kernels with newer additional features will not break existing profiles
Rewrites of a number of tools into different languages to make their use and packaging easier
Support for new kernel features such as v8 ABI network socket rules, xattr attachment conditionals, PERFMON and BPF capabilities
Improved compilar warnings and semantic checks
Improved support for kernels that support LSM stacking
Profile modes - enforce (default), kill and unconfined

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 89 Sep 03, 2020

Show notes

Overview

This week we farewell Joe McManus plus we look at security updates for Firefox, Chrony, Squid, Django, the Linux kernel and more.

This week in Ubuntu Security Updates

59 unique CVEs addressed

[USN-4473-1] libmysofa vulnerabilities [01:01]

5 CVEs addressed in Bionic (18.04 LTS)
OOB, NULL ptr deref, heap buffer overflow etc -> DoS

[USN-4474-1] Firefox vulnerabilities [01:30]

8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
80.0
Attacker controlled website -> DoS, install malicious extension, spoof URL bar, leak sensitive info across origins, RCE etc
NSS side-channel attacks etc
Race condition when importing a cert into the trust store (unspec impact)

[USN-4446-2] Squid regression [02:31]

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
Regression in recent squid update would cause issues if using icap or ecap protocols to do content adaptation

[USN-4475-1] Chrony vulnerability [02:51]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-14367
pid file is created as root before drops privileges and was susceptible to a symlink attack -> could be used to overwrite arbitrary files on the system

[USN-4476-1] NSS vulnerability [03:45]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-12403
OOB read for CHACHA20 decryption with undersized tag

[USN-4477-1] Squid vulnerabilities

3 CVEs addressed in Focal (20.04 LTS)
HTTP request smuggling

[USN-4478-1] Python-RSA vulnerability [04:15]

1 CVEs addressed in Trusty ESM (14.04 ESM)
- CVE-2020-13757
Ignores leading NUL/zero byte in decryption of ciphertext - fixed to check length matches block size

[USN-4479-1] Django vulnerabilities [04:40]

2 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-24584
- CVE-2020-24583
Incorrect handling of permissions on directories in caches - caused by a behavioural change in python 3.7 - so only affects Python Django when used with python 3.7 and hence say bionic (which uses python 3.6) is not affected

[USN-4480-1] OpenStack Keystone vulnerabilities [05:25]

4 CVEs addressed in Bionic (18.04 LTS)
Incorrect handling of EC2 permissions could allow an authenticated attacker to create EC2 credentials with elevated permissions
Incorrect handling of OAUTH1 roles could give an authenticated attacker more role assignments than intended
Incorrect handling of EC2 signature TTL checks could allow reuse of authorisation headers

[USN-4471-2] Net-SNMP regression [05:51]

2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS)
- CVE-2020-15862
- CVE-2020-15861
Previous update (Episode 87) caused `nsExtendCacheTime` to be not settable as MIB attribute - instead add cacheTime feature flag to set this

[USN-4481-1] FreeRDP vulnerabilities [06:23]

10 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
Various memory corruption and handling issues -> OOB reads / writes, UAF etc -> crash / RCE

[USN-4482-1] Ark vulnerability [06:54]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-24654
Crafted TAR with symlinks outside of working directory -> overwrite or creation of arbitrary files (zipslip but for tar - tarslip?)

[USN-4483-1] Linux kernel vulnerabilities [07:22]

13 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
5.4 kernel - focal - raspi / aws / gcp / oracle / azure / gcp etc for bionic
Memory leak in USB audio and USB testing drivers, DAX mremap, Speculative Store Bypass Disable (SSBD), Indirect Branch Predictor Barrier (IBPB) & Indirect Branch Speculation mitigation bypasses, crafted XFS metadata DoS, cgroupv2 reference count -> NULL ptr deref etc

[USN-4484-1] Linux kernel vulnerability

1 CVEs addressed in Bionic (18.04 LTS)
- CVE-2020-14356
5.3 gke/HWE kernel
cgroupv2 issue

[USN-4485-1] Linux kernel vulnerabilities

14 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS)
4.15 (bionic / xenial hwe / trusty esm azure)
Mostly same as above

[USN-4486-1] Linux kernel vulnerability

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS)
- CVE-2018-10323
4.4 (xenial / trusy esm hwe)
XFS metadata DoS

Goings on in Ubuntu Security Community

Farewell Joe McManus [09:04]

Thanks for being the best co-host a bloke could wish for

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 88 Aug 27, 2020

Show notes

Overview

This week we talk antivirus scanners and false positives in the Ubuntu archive, plus we look at security updates for QEMU, Bind, Net-SNMP, sane-backends and more.

This week in Ubuntu Security Updates

56 unique CVEs addressed

[USN-4467-1] QEMU vulnerabilities [00:52]

13 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
OOB read in SLiRP networking implementation when replying to a ICMP ping echo request -> malicious guest could leak host memory -> info leak
Network Block Device server assertion failure able to be triggered via a remote NBD client -> DoS
Malicious guest could cause a OOB write / read in SM501 graphic driver on host -> crash / code exec

[USN-4466-2] curl vulnerability [01:58]

1 CVEs addressed in Trusty ESM (14.04 ESM)
- CVE-2020-8231
Episode 87 - connect_only option -> could connect to wrong destination -> info leak

[USN-4468-1, USN-4468-2] Bind vulnerabilities [02:16]

5 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Assertion failures when handling:
- queries for zones signed by RSA signature
- truncated response to a TSIG-signed request
- queries when QNAME minimazation and forward first are enabled
- specially crafted large TCP payload on most recent versions (focal only)

[USN-4471-1] Net-SNMP vulnerabilities [03:10]

2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-15862
- CVE-2020-15861
Would cache MIBs in a directory on the host - an attacker who has read-write access to the SNMP service could use the NET-SNMP-EXTEND-MIB extension to modify an existing MIB to add a command to be executed when the MIB attribute is read, and this would be cached for future. In general net-snmp server runs as a low privileged user, so any command-exec is not privileged, except at startup when it runs as root and loads the cached MIBs - these could then contain commands to change the configuration of net-snmp to instead run as root and not drop privileges. Then subsequent runs of net-snmp will run as root and so any command-exec can be done as root. Fix is to both disable the EXTEND-MIB extension by default and to not cache MIBs.

[USN-4469-1] Ghostscript vulnerabilities [04:47]

25 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Fixes for various buffer overflows etc found via fuzzing with address sanitizer enabled - crafted PDF files -> crash / RCE

[USN-4470-1] sane-backends vulnerabilities [05:17]

8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Heap buffer overflows when accessing network attached scanners - could happen automatically when starting a scanning app which then scans the local network -> crash / code exec - found by GitHub security team
https://securitylab.github.com/research/last-orders-at-the-house-of-force
https://youtu.be/EGiQ-0pCcwc

[USN-4472-1] PostgreSQL vulnerabilities [06:25]

2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-14350
- CVE-2020-14349
2 issues in the mishandling of the search path, allowing a remote attacker to execute arbitrary SQL code - one when using logical replication and the other with CREATE EXTENSION command.

Goings on in Ubuntu Security Community

Windows Defender and other AVs flagging jq as possibly malicious [06:54]

https://discourse.ubuntu.com/t/several-av-engines-are-hating-on-usr-bin-jq-from-jq-1-6-1-false-positive-imo/18030
https://bugs.launchpad.net/ubuntu/+source/jq/+bug/1892843
https://bugs.launchpad.net/ubuntu/+source/jq/+bug/1892552
Windows Defender flags as Trojan:Linux/CoinMiner.N!MTB whilst Trend Micro flags as Trojan.SH.HADGLIDER.TSE - false positives, possible hash collision?

sudo apt install jq
xdg-open "https://www.virustotal.com/gui/file/$(sha256sum /usr/bin/jq | cut -f1 -d' ')"

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 87 Aug 21, 2020

Show notes

Overview

This week we look at the Drovorub Linux malware outed by the NSA/FBI plus we detail security updates for Dovecot, Apache, Salt, the Linux kernel and more.

This week in Ubuntu Security Updates

24 unique CVEs addressed

[USN-4456-1, USN-4456-2] Dovecot vulnerabilities [00:46]

3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
3 DoS issues - nested MIME -> resource exhaustion, Compuserve RPA auth mechanism (rare) -> zero length message -> assert fail, NTLM missing length check -> buffer over read -> crash

[USN-4457-1, USN-4457-2] Software Properties vulnerability [01:39]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-15709
add-apt-repository ANSI escape sequence display from launchpad PPA description

[USN-4458-1] Apache HTTP Server vulnerabilities [02:27]

5 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
mod_rewrite could be tricked into redirecting to an unexpected URL via newlines encoded into the request URL
use of uninitialized memory when proxying to a malicious FTP server -> info leak
2 HTTP/2 issues - improper handling of Cache-Digest headers and certain logging statements -> crash, DoS
buffer overflow in mod_proxy_uwsgi - crash / code exec

[USN-4459-1] Salt vulnerabilities [03:18]

5 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
File enumeration on remote server -> info leak
Authentication bypass
Command injection from unauthenticated users -> code exec on salt-api host
Failure to validate method calls and sanitize paths - access control bypass

[USN-4460-1] Oniguruma vulnerabilities [03:58]

4 CVEs addressed in Trusty ESM (14.04 ESM)
regex library used by PHP and Ruby -> various issues leading to DoS / info leak etc

[USN-4461-1] Ark vulnerability [04:20]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-16116
KDE archive handler - malicious ZIP files could contain files outside the working directory (zip-slip)

[USN-4465-1] Linux kernel vulnerabilities [04:50]

3 CVEs addressed in Bionic (18.04 LTS)
5.3 (hwe)
Memory leak in USB testing driver on disconnect - so physical attacker could add / remove device and eventually exhaust memory
bcache deadlock -> DoS
Crafted XFS metadata could cause a sync of excessive duration -> DoS

[USN-4462-1] Linux kernel vulnerability [05:53]

1 CVEs addressed in Bionic (18.04 LTS)
- CVE-2020-12771
5.0 (gke / oem)
bcache deadlock -> DoS

[USN-4463-1] Linux kernel vulnerabilities [06:06]

2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS)
- CVE-2020-15393
- CVE-2020-12771
4.4 (xenial / trusy esm hwe)
bcache deadlock
usb testing driver memory leak

[USN-4464-1] GNOME Shell vulnerability [06:24]

1 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-17489
Could show the login password when logging out if had set it visible during login

[USN-4466-1] curl vulnerability [06:53]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-8231
libcurl - improper handling of the CURLOPT_CONNECT_ONLY option -> could connect to wrong destination and so expose sensitive info

Goings on in Ubuntu Security Community

Joe and Alex discuss Drovorub Linux malware [07:24]

https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 86 Aug 13, 2020

Show notes

Overview

This week we discuss the recent announcement of a long-awaited native client for 1password, plus Google Chrome experiments with anti-phishing techniques, and we take a look at security updates for OpenJDK 8, Samba, NSS and more.

This week in Ubuntu Security Updates

13 unique CVEs addressed

[USN-4453-1] OpenJDK 8 vulnerabilities [01:03]

8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Usual mix of issues for a Java update - sandbox escape, DoS, information disclosure etc

[USN-4451-2] ppp vulnerability [01:29]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM)
- CVE-2020-15704
Episode 85

[USN-4454-1, USN-4454-2] Samba vulnerability [01:50]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-14303
A remote attacker could send a zero length UDP packet to Samba when acting as a AD DC with NetBIOS over TCP (NBT) enabled - would effectively enter an infinite loop -> CPU-based DoS

[USN-4455-1] NSS vulnerabilities [02:41]

3 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Fixes for various side-channel attacks against elliptic curve crypto implementations - could allow an attacker to infer the private key

Goings on in Ubuntu Security Community

Google Chrome 86 to only show domain in URL bar for phishing experiment [03:20]

Will only show just the domain in the URL bar to select users to see if this helps avoid phishing
- Presumably users will be less likely to mistake a URL like http://h.paypal.de-checking.net/de/ID.php?u=LhsdoOKJfsjdsdvg for a real paypay.com URL
One way to help avoid phishing, particularly for credentials, is to use a password manager that associates credentials with the site in question - so it should only offer to say fill-in your paypal credentials on a paypal.com site - and if it does not this is a hint it is not legitimate
- Has other benefits too like being able to autogenerate unique passwords per site, sync across devices etc

1password just launched a beta of their Linux client [06:46]

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 85 Aug 06, 2020

Show notes

Overview

Dr. Levi Perigo is our special guest this week to discuss SDN and NFV with Joe, plus Alex does the weekly roundup of security updates, including Ghostscript, Squid, Apport, Whoopsie, libvirt and more.

This week in Ubuntu Security Updates

37 unique CVEs addressed

[USN-4444-1] WebKitGTK vulnerabilities [00:48]

6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
Various issues in web / JS engines - remote attacker with a malicious website could cause XSS, DoS, RCE etc

[USN-4445-1] Ghostscript vulnerability [01:22]

1 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-15900
Integer overflow via `rsearch` operator - could allow to override file access controls and hence get code execution as the user who is viewing / processing the PS file - only affects most recent versions

[USN-4446-1] Squid vulnerabilities [02:24]

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
Jeriko One & Kristoffer Danielsson - incorrect cache handling -> cache injection attacks. Incorrect URN / URL handling -> bypass access / rule checks. Input validation failure -> crash, DoS

[USN-4298-2] SQLite vulnerabilities [03:07]

6 CVEs addressed in Trusty ESM (14.04 ESM)
Episode 66

[USN-4447-1] libssh vulnerability [03:27]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-16135
Under low memory conditions, could fail to allocate a buffer, would result in a NULL pointer dereference and hence crash

[USN-4448-1] Tomcat vulnerabilities [04:01]

3 CVEs addressed in Xenial (16.04 LTS)
Infinite loop if sent a WebSocket frame with an invalid payload length -> DoS if then sent multiple requests

[USN-4449-1] Apport vulnerabilities [04:23]

3 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
2 from Ryota Shiga:
- Failed to drop privileges correctly when invoking gdbus to determine if the user is closing their session -> would be invoked with root group privileges and using the environement of the user - they could override the DBUS_SESSION_BUS_ADDRESS environment variable, causing gdbus to connect to a spoofed dbus server and in the process to read a 16-byte nonce from a file of their choosing - allows to read arbitrary files that are 16-bytes of length
- TOCTOU issue when handling crash dump - if process PID gets recycled apport could include the wrong processes details in a crash dump that is then readable by other users - fixed to check process start time is at least before the time apport itself was invoked
1 from Seong-Joong Kim
- Unhandled exception when parsing users preferences configuration file -> crash, DoS

[USN-4450-1] Whoopsie vulnerabilities [07:24]

3 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
All 3 from Seong-Joong Kim
- Crash when trying to process a crafted crash file (tries to allocate too large amount of memory and crashes) -> DoS
- Integer overflow in vendored bson library when parsing a crafted crash dump -> heap overflow -> crash, RCE
- Memory leak when parsing crash dumps -> crafted report with many repeated key / value pairs -> OOM, crash -> DoS

[USN-4451-1] ppp vulnerability [09:18]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-15704
Ubuntu specific patch - pppd is setuid() root and would helpfully modprobe ppp_generic module when needed - but would not clear MODPROBE_OPTIONS environment module and so this could be used to either load other modules or read other files as root etc - fixed by removing this functionality since this has not been needed for a long time as ppp_generic has been built into the kernel since 2012 (ie there is no ppp_generic module to even load via modprobe)

[USN-4452-1] libvirt vulnerability [10:31]

1 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-15708
libvirt package sets up the libvirt socket via systemd - systemd unit specifies a SocketMode=0666 so is world writable :( - fixed to ensure systemd unit specifies this as only owner/group writable and ensures the owner is root and group is libvirt

[USN-4432-2] GRUB2 regression [11:10]

8 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
Legacy BIOS systems - grub core (in MBR) and modules (in file-system) could get out of sync if grub was not being installed onto the correct disk (this was the case for some users with manually configured RAID setups / particular cloud images etc) - fixed to just not do the grub install on the update to ensure they don’t get out of sync (since these vulnerabilities only are relevant to UEFI secure boot, no need for the update in BIOS boot systems).

[USN-4441-2] MySQL regression [12:58]

Affecting Focal (20.04 LTS)
Compiler options changed upstream and this could affect other libraries / apps which link against libmysqlclient - reverted this change since is not security relevant anyway

Goings on in Ubuntu Security Community

Joe talks SDN & NFV with Dr. Levi Perigo of the University of Colorado [13:28]

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 84 Jul 30, 2020

Show notes

Overview In a week when too many security updates are never enough, we cover the biggest one of them all for a while, BootHole, with an interview between Joe McManus and Alex Murray for some behind-the-scenes and in-depth coverage, plus we also look briefly at the other 100-odd CVEs for the week in FFmpeg, OpenJDK, LibVNCServer, ClamAV and more. This week in Ubuntu Security Updates 109 unique CVEs addressed [USN-4428-1] Python vulnerabilities [01:03] 4 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-14422 CVE-2019-9674 CVE-2019-20907 CVE-2019-17514 CPU based DoS via infinite loop in parsing a crafted tar archive [USN-4431-1] FFmpeg vulnerabilities [01:31] 9 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-13904 CVE-2020-12284 CVE-2019-17542 CVE-2019-17539 CVE-2019-13390 CVE-2019-13312 CVE-2019-12730 CVE-2019-11338 CVE-2018-15822 UAF, use of uninitialised variables, heap buffer over-read, NULL pointer deref etc - most via oss-fuzz [USN-4430-2] Pillow vulnerabilities [02:15] 5 CVEs addressed in Focal (20.04 LTS) CVE-2020-11538 CVE-2020-10994 CVE-2020-10379 CVE-2020-10378 CVE-2020-10177 2 buffer overflows in TIFF decoder [USN-4433-1] OpenJDK vulnerabilities [02:33] 8 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2020-14581 CVE-2020-14577 CVE-2020-14573 CVE-2020-14562 CVE-2020-14556 11.0.8 upstream release - thanks to Tiago from Foundations for preparing these Usual mix of issues for Java - possible sandbox escape, crash in TIFF decoder, failure to properly validate TLS certs in some cases etc [USN-4434-1] LibVNCServer vulnerabilities [03:11] 12 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-14405 CVE-2020-14404 CVE-2020-14403 CVE-2020-14402 CVE-2020-14401 CVE-2020-14400 CVE-2020-14399 CVE-2020-14398 CVE-2020-14397 CVE-2020-14396 CVE-2019-20840 CVE-2019-20839 2 NULL ptr deref, infinite loop -> DoS when closing connection, misaligned data access leading to possible crash, integer overflow, OOB read etc [USN-4435-1, USN-4435-2] ClamAV vulnerabilities [04:03] 3 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-3481 CVE-2020-3350 CVE-2020-3327 0.102.4 release NULL ptr deref on crafted EGG, race condition where could replace target dir with a symlink and get clamscan to remove that target, OOB read in ARJ decoder (previous fix Episode 76 was incomplete) [USN-4436-1, USN-4436-2] librsvg vulnerabilities / regression [04:55] 2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2019-20446 CVE-2017-11464 Update caused a regression since it removed a symbol - backed out, waiting for a more complete fix from upstream [USN-4437-1] libslirp vulnerability [05:26] 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-10756 OOB read in icmp6 echo reply - guest leaks contents of host memory -> info disclosure [USN-4438-1] SQLite vulnerability [05:45] 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-15358 Heap buffer overflow [USN-4439-1] Linux kernel vulnerabilities [05:51] 14 CVEs addressed in Bionic (18.04 LTS) CVE-2020-15780 CVE-2019-20908 CVE-2019-12380 CVE-2020-13974 CVE-2020-11935 CVE-2020-10768 CVE-2020-10767 CVE-2020-10766 CVE-2020-10757 CVE-2020-10732 CVE-2019-20810 CVE-2019-19462 CVE-2019-19036 CVE-2019-16089 5.0 (gke/oem) [USN-4440-1] Linux kernel vulnerabilities [06:05] 12 CVEs addressed in Bionic (18.04 LTS) CVE-2020-15780 CVE-2020-13974 CVE-2020-11935 CVE-2020-10768 CVE-2020-10767 CVE-2020-10766 CVE-2020-10757 CVE-2020-10732 CVE-2019-20908 CVE-2019-20810 CVE-2019-19462 CVE-2019-16089 5.3 (hwe / azure / gcp / gke / oracle) [USN-4441-1] MySQL vulnerabilities [06:17] 30 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-14702 CVE-2020-14697 CVE-2020-14680 CVE-2020-14678 CVE-2020-14663 CVE-2020-14656 CVE-2020-14654 CVE-2020-14651 CVE-2020-14643 CVE-2020-14641 CVE-2020-14634 CVE-2020-14633 CVE-2020-14632 CVE-2020-14631 CVE-2020-14624 CVE-2020-14623 CVE-2020-14620 CVE-2020-14619 CVE-2020-14597 CVE-2020-14591 CVE-2020-14586 CVE-2020-14576 CVE-2020-14575 CVE-2020-14568 CVE-2020-14559 CVE-2020-14553 CVE-2020-14550 CVE-2020-14547 CVE-2020-14540 CVE-2020-14539 8.0.21 (focal) 5.7.31 (bionic / xenial) [USN-4442-1] Sympa vulnerabilities [06:54] 3 CVEs addressed in Trusty ESM (14.04 ESM) CVE-2020-10936 CVE-2018-1000671 CVE-2018-1000550 Mailing list manager - possible privesc via injection of environment variables to run setuid wrappers arbitrary code [USN-4443-1] Firefox vulnerabilities [07:27] 9 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-15655 CVE-2020-15659 CVE-2020-15658 CVE-2020-15656 CVE-2020-15654 CVE-2020-15653 CVE-2020-15652 CVE-2020-6514 CVE-2020-6463 79.0 [USN-4432-1] GRUB 2 vulnerabilities [07:39] 8 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-15707 CVE-2020-15705 CVE-2020-14308 CVE-2020-14311 CVE-2020-14310 CVE-2020-14309 CVE-2020-15706 CVE-2020-10713 Goings on in Ubuntu Security Community Alex and Joe take an in-depth and behind-the-scenes look at BootHole / GRUB 2 [08:14] https://ubuntu.com/blog/mitigating-boothole-theres-a-hole-in-the-boot-cve-2020-10713-and-related-vulnerabilities https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass Alex hints at pending future secureboot-db update [23:55] https://uefi.org/revocationlistfile Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Our TOPPODCAST Picks

Follow Us

Stay Connected

Overview

This week in Ubuntu Security Updates

[USN-4488-2] X.Org X Server vulnerabilities [00:31]

[LSN-0071-1] Linux kernel vulnerability [00:50]

[USN-4494-1] GUPnP vulnerability [01:29]

[USN-4495-1] Apache Log4j vulnerability [03:21]

[USN-4496-1] Apache XML-RPC vulnerability [03:42]

[USN-4497-1] OpenJPEG vulnerabilities [03:58]

[USN-4499-1] MilkyTracker vulnerabilities [04:27]

[USN-4498-1] Loofah vulnerability [04:52]

[USN-4500-1] bsdiff vulnerabilities [05:16]

[USN-4501-1] LuaJIT vulnerability [05:40]

[USN-4502-1] websocket-extensions vulnerability [05:49]

[USN-4503-1] Perl DBI module vulnerability [06:21]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4487-1, USN-4487-2] libx11 vulnerabilities [00:58]

[USN-4488-1, USN-4490-1] X.Org X Server vulnerabilities [02:29]

[USN-4449-2] Apport vulnerabilities [03:28]

[USN-4474-2] Firefox regressions [03:38]

[USN-4489-1] Linux kernel vulnerability [04:09]

[USN-4491-1] GnuTLS vulnerability [06:01]

Goings on in Ubuntu Security Community

AppArmor3 slated for Ubuntu 20.10 [06:32]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4473-1] libmysofa vulnerabilities [01:01]

[USN-4474-1] Firefox vulnerabilities [01:30]

[USN-4446-2] Squid regression [02:31]

[USN-4475-1] Chrony vulnerability [02:51]

[USN-4476-1] NSS vulnerability [03:45]

[USN-4477-1] Squid vulnerabilities

[USN-4478-1] Python-RSA vulnerability [04:15]

[USN-4479-1] Django vulnerabilities [04:40]

[USN-4480-1] OpenStack Keystone vulnerabilities [05:25]

[USN-4471-2] Net-SNMP regression [05:51]

[USN-4481-1] FreeRDP vulnerabilities [06:23]

[USN-4482-1] Ark vulnerability [06:54]

[USN-4483-1] Linux kernel vulnerabilities [07:22]

[USN-4484-1] Linux kernel vulnerability

[USN-4485-1] Linux kernel vulnerabilities

[USN-4486-1] Linux kernel vulnerability

Goings on in Ubuntu Security Community

Farewell Joe McManus [09:04]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4467-1] QEMU vulnerabilities [00:52]

[USN-4466-2] curl vulnerability [01:58]

[USN-4468-1, USN-4468-2] Bind vulnerabilities [02:16]

[USN-4471-1] Net-SNMP vulnerabilities [03:10]

[USN-4469-1] Ghostscript vulnerabilities [04:47]

[USN-4470-1] sane-backends vulnerabilities [05:17]

[USN-4472-1] PostgreSQL vulnerabilities [06:25]

Goings on in Ubuntu Security Community

Windows Defender and other AVs flagging jq as possibly malicious [06:54]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4456-1, USN-4456-2] Dovecot vulnerabilities [00:46]

[USN-4457-1, USN-4457-2] Software Properties vulnerability [01:39]

[USN-4458-1] Apache HTTP Server vulnerabilities [02:27]

[USN-4459-1] Salt vulnerabilities [03:18]

[USN-4460-1] Oniguruma vulnerabilities [03:58]

[USN-4461-1] Ark vulnerability [04:20]

[USN-4465-1] Linux kernel vulnerabilities [04:50]

[USN-4462-1] Linux kernel vulnerability [05:53]

[USN-4463-1] Linux kernel vulnerabilities [06:06]

[USN-4464-1] GNOME Shell vulnerability [06:24]

[USN-4466-1] curl vulnerability [06:53]

Goings on in Ubuntu Security Community

Joe and Alex discuss Drovorub Linux malware [07:24]

Get in contact

Overview