Ubuntu Security Podcast

Latest Episodes:

Episode 33 May 27, 2019

Show notes

Overview

Updated Intel microcode for Cherry + Bay Trial CPUs, fixes for vulnerabilities in curl, Firefox, PHP and MariaDB, plus we talk configuration of virtualised guests to mitigate speculative execution vulnerabilities as well as plans for the Ubuntu 19.10 development cycle.

This week in Ubuntu Security Updates

43 unique CVEs addressed

[USN-3977-2] Intel Microcode update

4 CVEs addressed in Trusty ESM, Xenial, Bionic, Cosmic, Disco
Corresponding Intel microcode updates for Cherry Trail and Bay Trail CPU families

[USN-3989-1] LibRaw vulnerabilities

7 CVEs addressed in Xenial, Bionic, Cosmic
Multiple issues fixed:
- 2*NULL pointer dereference
- Heap-based buffer overflow
- Stack-based buffer overflow
- 3 different cases of possible infinite loop - CPU DoS

[USN-3990-1] urllib3 vulnerabilities

3 CVEs addressed in Xenial, Bionic, Cosmic, Disco
When validating certs for HTTPS, could specify a set of certs to validate against - however it would always include the system CA certs as well - so could validate successfully even if cert is not in chain of explicitly desired set - fixed to NOT include system certs in this case
Possible CRLF injection
Would possibly expose HTTP authorization credentials across different origin hosts as after authenticating, if being redirected to a different origin host, would still include the Authorization header from the old host to the new host - fixed by ensuring this defaults to being off

[USN-3991-1] Firefox vulnerabilities

17 CVEs addressed in Xenial, Bionic, Cosmic, Disco
Latest upstream Firefox release (67.0)
Includes fixes for various issues including:
- DoS, spoofing of browser UI, tricking users into launching local executables, XSS and RCE
- Tricking users into installing a malicious add-on by disabling the UI prompt
- History exposure via bookmark handling

[USN-3566-2] PHP vulnerabilities

5 CVEs addressed in Precise ESM, Trusty ESM
In February 2018, and March 2018, released updates for PHP5 in Trusty fixing multiple CVEs - this update is a corresponding update which fixes some new CVEs in both Precise ESM and Trusty ESM and some of the same older CVEs in Precise ESM.

[USN-3992-1] WebKitGTK+ vulnerabilities

3 CVEs addressed in Bionic, Cosmic, Disco
New upstream release (2.24.2) - like most WebKitGTK+ updates, contains little information on the new vulnerabilities - so assume the worst - DoS, XSS, RCE
Used by GNOME Shell for captive portal handling etc

[USN-3993-1, USN-3993-2] curl vulnerabilities

1 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic, Cosmic and Disco
- CVE-2019-5436
TFTP receive heap-based buffer overflow
1 CVEs addressed in Xenial, Bionic, Cosmic, Disco
- CVE-2019-5435
Integer overflow for 32-bit arches when handling a very large URL (>2GB) via the libcurl API (curl_url_set())

[USN-3957-2] MariaDB vulnerabilities

2 CVEs addressed in Trusty ESM
- CVE-2019-2627
- CVE-2019-2614
Episode 30 mentioned an update for MariaDB for the standard support releases fixing 8 CVEs - 2 of those applied to MariaDB in Trusty ESM - both where a privileged attacker can crash server

Goings on in Ubuntu Security Community

Clarifications to documentation regarding latest Intel MDS vulnerabilities

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown/TechFAQ
Updated to describe situation when doing virtualisation:
- To enable guest to mitigate various speculative execution vulnerabilities, need to ensure the guest CPU emulates the various CPU features (such as pcid, ssbd etc).
- Depends on workloads - if running untrusted code in guests or not etc.
- Previously QEMU would define various CPU models such as Broadwell-IBRS which would include support for this emulation. However, most of the newer features ssbd, md_clear etc are not included in these CPU models.
- So instead need to explicitly enable them - this can be done in a few ways:
  - Can just passthrough host CPU features directly - recommended approach if NOT going to migrating guests across hosts (since if has different features will cease to work)
  - Otherwise manually enable features directly as a subset of the supported features from all the various hosts in your datacenter - depending on whether using QEMU on the command-line or libvirt to configure has different ways to specify this but same idea for both

Security Team plans for 19.10 development cycle

19.10 cycle roadmap meeting was held in Lyon a 2 weeks ago - each Ubuntu team presented on the progress etc from the 19.04 cycle as well as their plans for the 19.10 cycle
Security team highlights for 19.10:
- Automate more parts of our processes around triage of code reviews, reactive package updates etc
- Review and incorporate KSPP recommendations for kernel hardening
- GCC -fstack-clash-protection and -fcf-protection as default
- Various snapd enhancements (daemon user, OpenGL support, audio migration)
- AppArmor features - prompting, more groundwork for fine-grained network mediation

Hiring

Robotics Security Engineer

https://boards.greenhouse.io/canonical/jobs/1550997

Security Certifications Engineer

https://boards.greenhouse.io/canonical/jobs/1660658

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
@ubuntu_sec on twitter

Episode 32 May 20, 2019

Show notes

Overview This week we look at updates to cover the latest Intel CPU vulnerabilities (MDS - aka RIDL, Fallout, ZombieLoad), plus other vulnerabilies in PostgreSQL, ISC DHCP, Samba and more, whilst special guest this week is Seth Arnold from the Ubuntu Security Team to talk Main Inclusion Review code audits. This week in Ubuntu Security Updates 37 unique CVEs addressed [USN-3972-1] PostgreSQL vulnerabilities 2 CVEs addressed in Xenial, Bionic, Cosmic, Disco CVE-2019-10130 CVE-2019-10129 Stores statistics for columns by sampling values from that column Security policy allows to restrict users from viewing particular rows But sampling would not take into account security policy User could craft a leaky operator which would return the sampled data and effectively bypass the security policy Fixed to only allow non-leakproof operators to use sampled data when no relevant row security policies in place Arbitrary server memory able to be read by executing a crafted INSERT statement on a partitioned table (only affects PostgreSQL 11 so only Disco) [USN-3973-1] DHCP vulnerability 1 CVEs addressed in Bionic, Cosmic CVE-2019-6470 DHCP server could crash due to mismatch in BIND internal memory management and DHCP server code BIND in Bionic + Cosmic contained a change which zeroed out an internal index to indicate it was unused - however 0 is still a valid index in the DHCP server codebase - and so this could cause a use-after free (since would be free’d, index set to 0 by BIND lib but then still used later since 0 is valid). Instead changed to track indexes correctly to account for this behaviour. [USN-3974-1] VCFtools vulnerabilities 3 CVEs addressed in Xenial CVE-2018-11130 CVE-2018-11129 CVE-2018-11099 Tools for working with VCF files (1000 Genomes Project) Fuzzed in conjunction with AddressSanitizer in clang using crafted VCF files Read-based heap buffer overflow - crash, DoS 2 * use after free -> crash, DoS / code execution [USN-3975-1] OpenJDK vulnerabilities 4 CVEs addressed in Xenial, Bionic, Cosmic, Disco CVE-2019-2698 CVE-2019-2697 CVE-2019-2684 CVE-2019-2602 2 affecting both openjdk-11 and openjdk-8 CPU DoS via BigDecimal implementation operating on particular values Sandbox escape due to incorrect skeleton class selection in the RMI registry 2 sandbox escapes affecting only openjdk-8 via the 2D graphics component [USN-3976-1, USN-3976-2] Samba vulnerability 1 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic, Cosmic, Disco CVE-2018-16860 Kerberos (as used in AD) contains an extension to allow a service to request a Kerberos ticket to itself on behalf of a non-Kerberos authenticated user (allows to use Kerberos for all internal code-paths) Can be proxied over the network so that a privileged server can proxy on behalf of the non-Kerberos authenticated user This proxied request contains a checksum (which can be keyed to prevent spoofing) - BUT this is not enforced - so an attacker can intercept the proxied request and rewrite the user name to any other one in the KDC AND replace the checksum with a simple CRC32 - as this can be computed without any prior knowledge [USN-3986-1] Wireshark vulnerabilities 9 CVEs addressed in Xenial, Bionic, Cosmic CVE-2019-9214 CVE-2019-9209 CVE-2019-9208 CVE-2019-10903 CVE-2019-10901 CVE-2019-10899 CVE-2019-10896 CVE-2019-10895 CVE-2019-10894 Updated to latest 2.6.8 release to fix many issues in various packet dissectors that would cause wireshark to crash [USN-3988-1] MediaInfo vulnerabilities 2 CVEs addressed in Bionic, Cosmic, Disco CVE-2019-11373 CVE-2019-11372 CLI tool for reading metadata from various audio/video files 2* OOB read -> crash, DoS [LSN-0051-1] Linux kernel vulnerability 4 CVEs for Microarchitectural Data Sampling (MDS) vulnerabilities CVE-2019-11091 CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/MDS https://www.redhat.com/en/blog/understanding-mds-vulnerability-what-it-why-it-works-and-how-mitigate-it https://www.redhat.com/en/blog/deeper-look-mds-vulnerability Too invasive to be addressed by Livepatch - requires updates to the kernel and new microcode to fix Intel CPUs contain various microarchitectural elements - store buffers, load ports, fill buffers - which get used to complete architectural operations (read from an address etc) 4 CVEs due to the different use of these different buffers in the various techniques RIDL (Rogue in-flight data load) - fill buffers and load ports Fallout - store buffers ZombieLoad - independent discovery of fill-buffer variant of RIDL These get reused across operations, and in particular get reused across hyperthreads executing on the same CPU core A malicious process can use speculative execution sampling techniques to infer the contents of one of these microarchitectural buffers - so could see data from a process that had previously been executing on the same CPU core OR in the case of HT can see data from a process executing concurrently on the same core In the case of a single core can be fixed by first adding new behaviour to the unused VERW instruction to clear these buffers as a microcode update Then updating the Linux kernel to call this new VERW instruction when switching tasks, VMs etc However, does not mitigate in the case of SMT So only way to properly mitigate is to disable SMT as well In the case of virtualisation, the guest does the task switching so it needs to clear these buffers - update to QEMU + libvirt to expose this new CPU capability to the guest so that it can perform the flushing itself Kernel + QEMU updates also contain fixes for other CVEs Kernels updated for all supported releases including the HWE kernels [USN-3977-1] Intel Microcode update 4 CVEs addressed in Trusty ESM, Xenial, Bionic, Cosmic, Disco CVE-2019-11091 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3978-1] QEMU update 7 CVEs addressed in Trusty ESM, Xenial, Bionic, Cosmic, Disco CVE-2019-9824 CVE-2019-5008 CVE-2019-11091 CVE-2018-20815 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3979-1] Linux kernel vulnerabilities 11 CVEs addressed in Disco CVE-2019-9503 CVE-2019-9500 CVE-2019-3887 CVE-2019-3882 CVE-2019-3874 CVE-2019-1999 CVE-2019-11683 CVE-2019-11091 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3980-1, USN-3980-2] Linux kernel vulnerabilities 10 CVEs addressed in Bionic (HWE), Cosmic CVE-2019-9503 CVE-2019-9500 CVE-2019-3887 CVE-2019-3882 CVE-2019-3874 CVE-2019-11091 CVE-2018-16884 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3981-1, USN-3981-2] Linux kernel vulnerabilities 9 CVEs addressed in Trusty ESM (HWE), Xenial (HWE), Bionic CVE-2019-9503 CVE-2019-9500 CVE-2019-3882 CVE-2019-3874 CVE-2019-11091 CVE-2018-16884 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3982-1, USN-3982-2] Linux kernel vulnerabilities 6 CVEs addressed in Trusty ESM (Xenial HWE), Xenial CVE-2019-3882 CVE-2019-3874 CVE-2019-11091 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3983-1, USN-3983-2] Linux kernel vulnerabilities 4 CVEs addressed in Precise ESM (Trusty HWE), Trusty ESM CVE-2019-11091 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3984-1] Linux kernel vulnerabilities 4 CVEs addressed in Precise ESM CVE-2019-11091 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 [USN-3985-1, USN-3985-2] libvirt update 4 CVEs addressed in Trusty ESM, Xenial, Bionic, Cosmic, Disco CVE-2019-11091 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 Goings on in Ubuntu Security Community Main inclusion review security code audits discussion with Seth Arnold Hiring Robotics Security Engineer https://boards.greenhouse.io/canonical/jobs/1550997 Security Certifications Engineer https://boards.greenhouse.io/canonical/jobs/1660658 Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network @ubuntu_sec on twitter

Full show notes at the publisher

Episode 31 May 13, 2019

Show notes

Overview

This week we cover security fixes for GNOME Shell, FFmpeg, Sudo, Ghostscript and others, and we talk to Joe McManus about malicious Dockerhub images, Git repos being ransomed more.

This week in Ubuntu Security Updates

14 unique CVEs addressed

[USN-3966-1] GNOME Shell vulnerability

1 CVEs addressed in Bionic, Cosmic
- CVE-2019-3820
Local user could potentially bypass various restrictions of the lock screen - menu items can be activated by keyboard combinations - these could then be used to take screenshots (and fill up disk space), close windows behind the lock screen or start the screen reader which could read out the contents of windows behind the lock screen.
Fixed by disabling all menu items when the screen is locked

[USN-3965-1] aria2 vulnerability

1 CVEs addressed in Cosmic, Disco
- CVE-2019-3500
CLI download tool (akin to curl / wget but can also do bittorrent and others)
When logging would store credentials in log file which could be read by other users
Fixed by masking out credentials

[USN-3967-1] FFmpeg vulnerabilities

5 CVEs addressed in Bionic, Cosmic, Disco
CPU DoS in Matroska and HTML subtitle decoding
Various issues discovered by Google’s oss-fuzz project:
- 2 x OOB read found by Google’s clusterfuzz / oss-fuzz project in MPEG-4 decoder
- NULL pointer dereference and OOB read in HEVC decoder
Assertion failure for missing audio packet size in FLV encoder

[USN-3968-1] Sudo vulnerabilities

2 CVEs addressed in Xenial
- CVE-2017-1000368
- CVE-2016-7076
Fails to properly parse /proc/PID/stat - this is used to determine the controlling tty - this name could contain newlines - sudo would only read one line of input and so would get a truncated name - when sudo is used with SELinux this allows to confuse sudo as to where the destination for stdout / stderr and so cause sudo to overwrite and arbitrary file by creating a symlink from the supposed tty to the destination file.
Fixed by ensuring to parse the full name including any newlines
sudo contains the ability to restrict users with sudo access to running further commands via the NOEXEC tag
- Does this by LD_PRELOAD to replace exec() and other functions with versions that return an error
- wordexp() performs shell expansion on a string and so can contain shell directives to run a command and get the output $(foo) - this can run commands and so would not be stopped by LD_PRELOAD lib - so a user can run a binary which does wordexp() they could bypass this restriction
- Fixed by adding wordexp() to the LD_PRELOAD wrapper AND by adding a seccomp filter to stop all execve() entirely

[USN-3969-1, USN-3969-2] wpa_supplicant and hostapd vulnerability

1 CVEs addressed in Trusty ESM, Xenial, Bionic, Cosmic, Disco
- CVE-2019-11555
Possible NULL pointer dereference if an attacker could construct out of sequence EAP message fragments
Fixed by validating and rejecting invalid fragments on both the peer and server side

[USN-3970-1] Ghostscript vulnerability

1 CVEs addressed in Xenial, Bionic, Cosmic, Disco
- CVE-2019-3839
Follow up to CVE-2019-6116 (Episode 18)
- GS sandbox allowed access to system operators which allowed arbitrary code execution
- Missed some protections for pdf related operations which could also allow code execution

[USN-3971-1] Monit vulnerabilities

2 CVEs addressed in Cosmic, Disco
- CVE-2019-11455
- CVE-2019-11454
Buffer over-read when decoding URLs could allow a remote authenticated attacker to read other memory - information disclosure but could also cause a crash via reading from an invalid memory location
Persistent XSS in decoding Authorization header for HTTP Basic Authorization could allow an unauthenticated remote attacker to inject arbitrary JavaScript in the _viewlog operation - fixed by properly escaping this data

[USN-3956-2] Bind vulnerability

1 CVEs addressed in Precise ESM, Trusty ESM
- CVE-2018-5743
Episode 29 covered for standard support releases - now fixed in ESM

Discussion with Joe McManus about malicious DockerHub images and Git repo takeover ransoms

Goings on in Ubuntu Security Community

Robotics Security Engineer

https://boards.greenhouse.io/canonical/jobs/1550997

Security Certifications Engineer

https://boards.greenhouse.io/canonical/jobs/1660658

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
@ubuntu_sec on twitter

Episode 30 May 06, 2019

Show notes

Overview

Fixes for 19 different vulnerabilities across MySQL, Dovecot, Memcached and others, plus we talk to Joe McManus about the recent iLnkP2P IoT hack and the compromise of DockerHub’s credentials database and more.

This week in Ubuntu Security Updates

19 unique CVEs addressed

[USN-3957-1] MySQL vulnerabilities

8 CVEs addressed in Xenial, Bionic, Cosmic, Disco
Latest upstream version 5.7.26 includes fixes for 8 different issues including:
- Unauthenticated remote attacker could gain complete access to all MySQL server data
- Multiple versions of privileged attacker could hang / crash MySQL server

[USN-3958-1] GStreamer Base Plugins vulnerability

1 CVEs addressed in Xenial, Bionic, Cosmic
- CVE-2019-9928
Heap based buffer overflow in RTSP connection parser - could allow a malicious server to gain remote code execution on the client - session id can contain attributes separated by semi-colons - would assume when encountering a semi-colon that this delimits the maximum size of the session id - however the session id has a maximum size of 512 bytes - would overflow by using the user-supplied session id length rather than sticking to the maximum structure length - changed to only parse up to the maximum size of the structure to ensure we then don’t overflow when copying

[USN-3959-1] Evince vulnerability

1 CVEs addressed in Xenial, Bionic, Cosmic, Disco
- CVE-2019-11459
Failed to check return values when calling functions for libTIFF - these return the pixel data from an embedded TIFF image - on failure would end up rendering uninitialised memory rather than the TIFF image - fixed to check return values and bail out on error

[USN-3960-1] WavPack vulnerability

1 CVEs addressed in Bionic, Cosmic, Disco
- CVE-2019-11498
Fuzzing via valgrind - found if no sample rate was specified then a stack declared but uninitialized value would be used - could cause a crash etc since could be anything - fixed to initialise it to 0 and to check if still zero before proceeding to process

[USN-3961-1] Dovecot vulnerabilities

2 CVEs addressed in Cosmic, Disco
- CVE-2019-11499
- CVE-2019-11494
Two issues related to authentication in recent versions of dovecot - if client aborts authentication the serer could crash due to a NULL pointer dereference, and if using TLS but send an invalid authentication message could crash as well

[USN-3962-1] libpng vulnerability

1 CVEs addressed in Bionic, Cosmic
- CVE-2019-7317
Use after free in png image cleanup - originally was called under png_safe_execute() - this is an internal function which itself calls png_image_free() - so after freeing the image would free it a second time in certain conditions - changed to just call the free function directly rather than via png_safe_execute()

[USN-3963-1] Memcached vulnerability

1 CVEs addressed in Bionic, Cosmic, Disco
- CVE-2019-11596
Possible NULL pointer dereference via local command interface due to insufficient checks when parsing input - commands require 4 input tokens but only checked for 3 (off-by-one) - could allow an attacker with access to the command interface to crash memcached

[USN-3953-2] PHP vulnerabilities

2 CVEs addressed in Precise ESM, Trusty ESM
- CVE-2019-11035
- CVE-2019-11034
Episode 29 covered these for standard supported releases - this update is for the ESM releases - two bugs in EXIF tag handling

[USN-3964-1] python-gnupg vulnerabilities

2 CVEs addressed in Bionic, Cosmic, Disco
- CVE-2019-6690
- CVE-2018-12020
Possible to trick gnupg to decrypt ciphertext other than the intended one when an attacker can control the passphrase to gnupg and the ciphertext is assumed trusted - this uses the command-interface of gnupg and passes the passphrase directly to it - along with the ciphertext - so if attacker includes newlines in the supplied passphrase can then inject their own ciphertext (or plaintext in the context of encryption) - fixed to check passphrase does not contain line-feed or carriage return characters
Possible to trick by including what looks like the return response from gnupg directly in the filename to be decrypted when using verbose output mode - fixed by sanitising this filename first

Discussion with Joe McManus about another IoT compromise and DockerHub

Goings on in Ubuntu Security Community

Hiring

Robotics Security Engineer

https://boards.greenhouse.io/canonical/jobs/1550997

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
@ubuntu_sec on twitter

Episode 29 Apr 30, 2019

Show notes

Overview

This week we look at fixes from the past two weeks including BIND, NTFS-3G, Dovecot, Pacemaker and more, plus we follow up last episodes IoT security discussion with Joe McManus talking about Ubuntu Core. Finally we cover the release of Ubuntu 19.04 Disco Dingo and the transition of Ubuntu 14.04 Trusty Tahr to Extended Security Maintenance.

These past two weeks in Ubuntu Security Updates

53 unique CVEs addressed

[USN-3947-1, USN-3947-2] Libxslt vulnerability

1 CVEs addressed in Precise ESM, Trusty, Xenial, Bionic, Cosmic
- CVE-2019-11068
Library to transform XML via XML definitions
Includes a security framework since XSLT can define operations to fetch/read/write files and resources etc
Various functions would return 0 if an operation is not allowed by the framework which was checked for and correctly disallowed - BUT they could also return -1 on error (say from a potentially bad URL) which would not be caught and so then would proceed and would fetch from the URL in question thereby violating the security policy
Fixed to also check for error codes on handle the same as an explicit policy violation

[USN-3948-1] WebKitGTK+ vulnerabilities

14 CVEs addressed in Bionic, Cosmic
Wide mix of issues fixed including XSS and DoS attacks or possible arbitrary code execution if visiting a malicious website

[USN-3949-1] OpenJDK 11 vulnerability

1 CVEs addressed in Bionic
- CVE-2019-2422
Backport of openjdk-11 from Disco to Bionic, includes a minor security fix to memory disclosure vulnerablity which could enable an attacker to bypass sandbox

[USN-3918-4] Firefox regressions

17 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
Episode 26 covered 66.0.2 regression - this is now 66.0.3 to fix further regressions in keyboard handling as discussed previously

[USN-3914-2] NTFS-3G update

Affecting Xenial, Bionic, Cosmic
Episode 25 covered ntfs-3g update for possible heap buffer overflow
- As was setuid root this could possibly be used for root privilege escalation
This update removes setuid root to additionally harden ntfs-3g so that any future vulnerablilites can’t be used for privilege escalation

[USN-3950-1] ZNC vulnerability

1 CVEs addressed in Cosmic
- CVE-2019-9917
crash -> DoS due to improper handling of character encoding - if a remote user specified an invalid encoding it could cause znc to crash
Fixed to fallback to utf-8 if unknown encoding specified

[USN-3951-1] Dovecot vulnerability

1 CVEs addressed in Cosmic, Disco
- CVE-2019-10691
Only affects Dovecot 2.3 and hence only Cosmic, Disco, Eoan etc
Improper handling of invalid utf-8 username in JSON encoding could cause the authentication service to crash

[USN-3952-1] Pacemaker vulnerabilities

3 CVEs addressed in Xenial, Bionic, Cosmic, Disco
Cluster resource manager - high availability and load balancing for OpenStack
All discovered by Jan Pokorný - local attacker could possibly escalate privileges or cause a denial of service or to cause sensitive information to be leaked to system logs

[USN-3953-1] PHP vulnerabilities

2 CVEs addressed in Xenial, Bionic, Cosmic, Disco
- CVE-2019-11035
- CVE-2019-11034
php7.2 and php7.0
Buffer over-read when processing certain EXIF tags - possible information disclosure or crash -> DoS

[USN-3922-2, USN-3922-3] PHP vulnerabilities

7 CVEs addressed in Precise ESM, Trusty
Most covered back in Episode 26

[USN-3936-2] AdvanceCOMP vulnerability

1 CVEs addressed in Disco
- CVE-2019-9210
Corresponding update for Disco - covered in Episode 27

[USN-3954-1] FreeRADIUS vulnerabilities

2 CVEs addressed in Bionic, Cosmic, Disco
- CVE-2019-11235
- CVE-2019-11234
2 possible “Dragonblood” authentication bypass issues - mentioned back in Episode 28 in the context of wpa_supplicant and hostapd - similar issue for FreeRADIUS

[USN-3955-1] tcpflow vulnerabilities

2 CVEs addressed in Xenial, Bionic, Cosmic
- CVE-2018-18409
- CVE-2018-14938
Stack based buffer overflow and an integer overflow -> usual effects (crash -> DoS / information disclosure)

[USN-3956-1] Bind vulnerability

1 CVEs addressed in Xenial, Bionic, Cosmic, Disco
- CVE-2018-5743
DoS - possible to bypass bind’s limits on simultaneous TCP clients and so cause a DoS via excessive resource usage

IoT Security follow-up with Joe McManus

Alex and Joe follow up on last episode’s conversation about IoT and in particular talk about Ubuntu Core and how this has been engineered to address many of these common IoT security design and implementation flaws

Goings on in Ubuntu Security Community

Ubuntu 19.04 Disco Dingo Released

Released on Thursday 18th April
Officially supported by Canonical for 9 months - with security fixes for packages in main by the security team

Ubuntu 14.04 Trusty Tahr transitions to Extended Security Maintenance

Standard support period concluded on Thursday 25th April
Users are encouraged to upgrade to our latest LTS release 18.04 via 16.04
Extended security maintenance is now available via Ubuntu Advantage
https://blog.ubuntu.com/2019/02/05/ubuntu-14-04-trusty-tahr
https://www.ubuntu.com/esm

Hiring

Ubuntu Security Generalist

https://boards.greenhouse.io/canonical/jobs/1548812

Robotics Security Engineer

https://boards.greenhouse.io/canonical/jobs/1550997

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
@ubuntu_sec on twitter

Episode 28 Apr 15, 2019

Show notes

Overview

This week we look at updates for vulnerabilities in wpa_supplicant, Samba, systemd, wget and more and we talk to Joe about IoT security (or the prevailing lack-thereof).

This week in Ubuntu Security Updates

27 unique CVEs addressed

[USN-3939-1, USN-3939-2] Samba vulnerability

1 CVEs addressed in Precise ESM, Trusty, Xenial, Bionic, Cosmic
- CVE-2019-3880
Symlink path traversal vulnerability in the Windows Registry service emulation RPC API end-point
Allows a local user to create a new registry file anywhere they have Unix permissions to do so within the Samba share
- Bypasses share restrictions such as read-only and share ACLs
- Also allows to create the file outside the share itself if there is already a symlink pointing outside the shared areas
Fixed by removing the ability to save or restore registry keys at all via this RPC API end-point

[USN-3940-1, USN-3940-2] ClamAV vulnerabilities

3 CVEs addressed in Precise ESM, Trusty, Xenial, Bionic, Cosmic
3 file-handling issues
- 2 OOB heap read when handling PE (Windows EXE and DLL) and PDF files -> crash -> DoS
- OOB heap write when scanning OLE2 files (old format Microsoft Office documents), crash -> DoS or possible code execution

[USN-3941-1] Lua vulnerability

1 CVEs addressed in Xenial, Bionic, Cosmic
- CVE-2019-6706
UAF if calling debug.upvaluejoin() with the same function for both function parameters

[USN-3938-1] systemd vulnerability

1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
- CVE-2019-3842
Failure to properly sanitize environment before using XDG_SEAT
Attacker could set XDG_SEAT such that they can have actions checked against the wrong PolicyKit policy
Allows a remotely logged in attacker (SSH) to run commands which should be restricted to only physically present users
Fixed by using secure_getenv() rather than just getenv() - so that if running via su the existing value is effectively scrubbed from the environment and ignored

[USN-3942-1] OpenJDK 7 vulnerability

1 CVEs addressed in Trusty
- CVE-2019-2422
Information leak allows a remote attacker to possibly leverage this to bypass the Java sandbox

[USN-3943-1, USN-3943-2] Wget vulnerabilities

2 CVEs addressed in Trusty, Xenial, Bionic, Cosmic (1 in Precise ESM)
- CVE-2019-5953
- CVE-2018-20483
Heap buffer overflow due to improper memory management - crash -> DoS or possible code execution
By default wget would store the origin URL in an extended attribute on the downloaded file
- Could include username / password
- getfattr -d to dump
- changed to NOT store extended attributes by default AND to strip out any credentials when doing so
- doesn’t effect Precise ESM

[USN-3937-2] Apache vulnerabilities

4 CVEs addressed in Precise ESM
Episode 27 covered mod_auth_digest bypass for other supported releases
Also includes 3 other issues:
- Nonce generated to prevent reply attacks for HTTP digest authentication challenenge wasn’t sufficiently random
  - Could allow and attacker to reply across a cluster of servers with the same common digest authentication configuration
  - changed to actually use a proper random source
- Possible OOB read -> crash -> DoS
- Possible one-byte memory corruption if specify a character encoding of only 1 byte (since assumes is at least 2 bytes and so writes a NULL at index +2 which could be past the end of the header) - crash, DoS

[USN-3944-1] wpa_supplicant and hostapd vulnerabilities

5 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
Fix fallback to low-quality PRNG if failed to get an actual random value for a WPS pin
Multiple vulnerabilities discovered in the implementation of WPA3 in hostapd and wpa_supplicant (aka Dragonblood)
- 2 apply to SAE (Simultaneous Authentication of Equals , also known as Dragonfly Key Exchange) not relevant since we don’t enable SAE support in our builds (this is used for initial key exchange instead of PSK)
- 4 apply to the use of EAP-PWD - Extensible Authentication Protocol Password
  - cache side channel attack
  - reflection attack
    - may allow an attacker to authenticate without the password but likely not derive session key or complete the key exchange so no loss of confidentiality
  - 2 failure to validate crypto components
    - could allow attacker to authenticate AND gain access to session key and get network access

[USN-3945-1] Ruby vulnerabilities

6 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
Symlink directory traversal issue - gem would delete the target destination before creating any new directories or files when extracting a Gem - as this is often run via sudo could allow to delete anything on target system
- Fixed to check target paths are symlinks
5 different code-injection attacks:
- 4 via injection of terminal escape sequences in debug code paths to stdout
- one via eval() of the stub line in a gemspec file

[USN-3946-1] rssh vulnerabilities

3 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
Possible to execute arbitrary shell commands since failed to properly sanitize environment variables and command-line arguments when executing rsync or scp
Removed from archive in disco since dead upstream

Goings on in Ubuntu Security Community

IoT Security discussion with Joe McManus

Hiring

Ubuntu Security Generalist

https://boards.greenhouse.io/canonical/jobs/1548812

Robotics Security Engineer

https://boards.greenhouse.io/canonical/jobs/1550997

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
@ubuntu_sec on twitter

Episode 27 Apr 08, 2019

Show notes

Overview Carpe Diem for Apache HTTP Server, plus updates for Dovecot, PolicyKit and the Linux kernel, and we talk to Joe McManus about the recent Asus ShadowHammer supply chain attack and more. This week in Ubuntu Security Updates 52 unique CVEs addressed [USN-3928-1] Dovecot vulnerability 1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-7524 Local user root privilege escalation Stack buffer overflow - indexer-worker processes missing bounds check when copying from the index If local user can modify the dovecot index then could leverage this for code-execution in the indexer process context Mitigated by usual hardening techniques (ASLR, stack-protector, read-only GOT (via RELRO & BIND_NOW)) [USN-3929-1] Firebird vulnerabilities 2 CVEs addressed in Trusty CVE-2017-6369 CVE-2014-9323 Remote authenticated users execute code Remote un-authenticated user DoS via op_response action with a non-empty status [USN-3934-1] PolicyKit vulnerability 1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-6133 Episode 23 - fixed kernel to make process start_time via fork() more atomic Updated policykit to also check UIDs match (so now checks start_time, PID and UID so can’t use another user’s authorisations) [USN-3935-1] BusyBox vulnerabilities 10 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-5747 CVE-2018-20679 CVE-2018-1000517 CVE-2017-16544 CVE-2017-15873 CVE-2016-2148 CVE-2016-2147 CVE-2015-9261 CVE-2014-9645 CVE-2011-5325 Mix of issues across various components in BusyBox udhcpc: Information disclosure of stack memory in dhcp client / server (shared component) due to failure to check DHCP options are correct size - original fix was incomplete so this got 2 CVEs Heap buffer overflow via DHCP option parsing of OPTION_6RD (IPv6 rapid deployment on IPv4 infra) Integer overflow -> heap-based OOB write -> crash -> DoS / code execution wget: Heap buffer overflow in wget shell: Failure to sanitize filenames during tab completion - could allow code execution etc as user who is running the shell archive handling Integer overflow in bzip2 decompression - OOB write - crash -> DoS / code execution? Pointer misuse in zip decompression - OOB read - crash -> DoS directory traversal due to symlinks which point outside the current working directory when decompressing tar archives (tyhicks) module loading allows users to load modules which are otherwise restricted - assumes modules could specify the path so uses basename() on the module name - so just need to include a / in the module name to circumvent other checks [USN-3937-1] Apache HTTP Server vulnerabilities 6 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-0220 CVE-2019-0217 CVE-2019-0196 CVE-2018-17199 CVE-2018-17189 CVE-2019-0211 “Carpe Diem” and others Local root privilege escalation due to an OOB array access resulting in arbitrary function call when apache gracefully restarts - done daily via logrotate at 6:25am affects mod_prefork, mod_worker and mod_event main server (running as root) shares a memory segment (the scoreboard) with low-privileged worker processes PID, last request handled etc - maintained by the worker worker stores an index into global buckets array in the privileged parent this gets used on restart to restart the worker but no check is done to ensure this is valid so since is in shm child can change this index to ensure it points back into the shm segment where it has write access the bucket contains a function pointer to restart worker - so since this is now indexed from the shm segment can make this point to any function of choice - AND this gets executed as root by the parent Requires some other bug to turn this into a remote exploit since need to get R/W access remotely on a worker process Failure to normalize URLs in a consistent manner - LocationMatch and RewriteRule might not get applied correctly Race condition in mod_auth_digest could allow user with valid credentials to impersonate another and bypass access controls read after free on string comparison in mod_http2 - crash, DoS failure to respect session expiry time in mod_session_cookie DoS via slow-loris type attack to occupy server threads [USN-3936-1] AdvanceCOMP vulnerability 1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-9210 Integer overflow when decompressing invalid PNG images - OOB write and heap OOB read [USN-3930-1, USN-3930-2] Linux kernel vulnerabilities 13 CVEs addressed in Cosmic and Bionic (HWE) CVE-2019-9213 CVE-2019-9162 CVE-2019-9003 CVE-2019-8980 CVE-2019-8956 CVE-2019-8912 CVE-2019-7308 CVE-2019-7222 CVE-2019-7221 CVE-2019-6974 CVE-2019-3460 CVE-2019-3459 CVE-2018-19824 Jann Horn (GPZ): mmap minimum address bypass - could allow to turn a kernel NULL pointer dereference into code execution ASN.1 decoding for SNMP NAT missing length checks - OOB R/W possible side-channel attack due to speculation on pointer arithmetic in eBPF programs (Spectre V1) mitigated when secure boot due to lockdown patches blocking BPF program loading Reference counting race-condition in KVM -> UAF -> guest VM crash UAF + OOPS in IPMI due to race-condition on restart Memory leak on error path of vfs read operations -> DoS UAF in SCTP sendmsg - crash / code execution UAF in AF_ALG due to failure to NULL structure members Originally misclassified by NVD as remotely exploitable, confusion over socket() use by crypto API? Info leak and a UAF in KVM when using nested virtualisation - not enabled by default in Ubuntu kernels unless if install QEMU - this is enabled automatically 2 different information leak of heap memory in bluetooth subsystem triggerable by unauthenticated remote attacker UAF in ALSA USB sound device handling mentioned in Episode 20 [USN-3931-1, USN-3931-2] Linux kernel vulnerabilities 12 CVEs addressed in Bionic, Trusty (HWE) and Xenial (HWE) CVE-2019-9213 CVE-2019-8980 CVE-2019-8912 CVE-2019-7308 CVE-2019-7222 CVE-2019-7221 CVE-2019-6974 CVE-2019-3460 CVE-2019-3459 CVE-2018-19824 CVE-2018-18021 CVE-2018-14678 10 from above, 2 unique: Potential host system crash / code execution from malicious guest for KVM on ARM64 as mentioned previously in Episode 12 Failure to properly initialise all elements of error handler callback in Xen - guest VM crash triggerable by an unprivileged attacker in the guest VM [USN-3932-1, USN-3932-2] Linux kernel vulnerabilities 20 CVEs addressed in Xenial and Trusty (HWE) CVE-2019-3819 CVE-2019-3701 CVE-2018-9517 CVE-2018-16884 CVE-2018-14613 CVE-2018-14612 CVE-2018-14611 CVE-2018-14610 CVE-2018-14616 CVE-2018-14614 CVE-2018-13100 CVE-2018-13099 CVE-2018-13097 CVE-2017-18249 CVE-2019-9213 CVE-2019-7222 CVE-2019-7221 CVE-2019-6974 CVE-2019-3460 CVE-2019-3459 2 DoS triggerable by root (low priority issue) UAF in PPP over L2TP UAF in NFS41+ when using multiple network namespaces 4 different NULL pointer dereferences in btrfs via malicious image Race condition and various reads of invalid memory areas when mounting malicious f2fs images mmap min address bypass and others mentioned previously plus (bluetooth, kvm etc) [USN-3933-1, USN-3933-2] Linux kernel vulnerabilities 8 CVEs addressed in Trusty and Precise ESM (HWE) CVE-2019-9213 CVE-2019-7222 CVE-2019-6974 CVE-2019-3460 CVE-2019-3459 CVE-2018-19824 CVE-2017-18360 CVE-2017-1000410 Goings on in Ubuntu Security Community Supply chain attacks and Ubuntu Alex and Joe discuss recent Asus ShadowHammer supply chain attack and how this relates to Ubuntu https://securelist.com/operation-shadowhammer/89992/ https://www.forbes.com/sites/jasonevangelho/2019/03/29/shadowhammer-asus-1-million-reasons-switch-from-windows-to-linux/ https://www.synopsys.com/content/dam/synopsys/sig-assets/reports/2018-ossra.pdf http://go.coverity.com/rs/157-LQW-289/images/2014-Coverity-Scan-Report.pdf Hiring Ubuntu Security Generalist https://boards.greenhouse.io/canonical/jobs/1548812 Robotics Security Engineer https://boards.greenhouse.io/canonical/jobs/1550997 Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network @ubuntu_sec on twitter

Full show notes at the publisher

Episode 26 Apr 01, 2019

Show notes

Overview This week we look security updates for a heap of packages including Firefox & Thunderbird, PHP & QEMU, plus we discuss Facebook’s recent password storage incident as well as some listener hardening tips and more. This week in Ubuntu Security Updates 48 unique CVEs addressed [USN-3919-1] Firefox vulnerabilities 2 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-9813 CVE-2019-9810 Firefox 66.0.1 (mentioned briefly last week) - fixes two vulnerabilities discovered during Pwn2Own Both in the IonMonkey JIT compiler Incorrect alias information for the Array.prototype.slice method leads to missing bounds check and a buffer overflow - code execution as a result Type confusion in handling of ,__proto__ mutations - ,__proto__ is used to modify the Prototype of an object to be mutated - used for object inheritance in JavaScript - allows arbitrary memory read/write and therefore code execution as a result [USN-3918-2] Firefox vulnerabilities 17 CVEs addressed in Trusty CVE-2019-9803 CVE-2019-9793 CVE-2019-9809 CVE-2019-9808 CVE-2019-9807 CVE-2019-9806 CVE-2019-9805 CVE-2019-9802 CVE-2019-9799 CVE-2019-9797 CVE-2019-9796 CVE-2019-9795 CVE-2019-9792 CVE-2019-9791 CVE-2019-9790 CVE-2019-9789 CVE-2019-9788 Firefox 66 & 66.0.1 - Episode 25 covered for Xenial, Bionic and Cosmic [USN-3918-3] Firefox regression 17 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-9803 CVE-2019-9793 CVE-2019-9809 CVE-2019-9808 CVE-2019-9807 CVE-2019-9806 CVE-2019-9805 CVE-2019-9802 CVE-2019-9799 CVE-2019-9797 CVE-2019-9796 CVE-2019-9795 CVE-2019-9792 CVE-2019-9791 CVE-2019-9790 CVE-2019-9789 CVE-2019-9788 Firefox 66 & 66.0.1 contained a regression - so upstream released 66.0.2 Broke keyboard handling in Office 365, iCloud and IBM WebMail - Firefox 66 changed the way keycode handling works so these websites and others which use older, deprecated methods to get the keycode have been added to an internal fallback list to use the old method [USN-3927-1] Thunderbird vulnerabilities 10 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-9793 CVE-2019-9813 CVE-2019-9810 CVE-2019-9796 CVE-2019-9795 CVE-2019-9792 CVE-2019-9791 CVE-2019-9790 CVE-2019-9788 CVE-2018-18506 Thunderbird 60.6.1 Rolls in security fixes covered previous for Firefox (66.0, 66.0.1) Both the Pwn2Own and previous fixes As for Firefox, listen back to Episode 25 for details of 66.0 fixes [USN-3921-1] XMLTooling vulnerability 1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-9628 Crash due to uncaught DOMException able to be triggered by a malformed XML document - DoS Thanks to Etienne Dysli Metref who provided debdiff’s as well as testing for this update [USN-3922-1] PHP vulnerabilities 5 CVEs addressed in Xenial, Bionic, Cosmic CVE-2019-9641 CVE-2019-9640 CVE-2019-9639 CVE-2019-9638 CVE-2019-9637 Integer overflow on 32-bit archs when processing malformed EXIF image data - crash, DoS Failure to check available data length when processing image thumbnails - OOB read -> crash -> DoS OOB read of 1 byte when handling EXIF image data - crash -> DoS During file rename, if file is moved across file-systems, the new file briefly is world readable allowing anyone to read it - fixed by ensuring umask is used correctly so that the new file always has restrictive permissions from the outset [USN-3923-1] QEMU vulnerabilities 11 CVEs addressed in Trusty, Xenial, Bionic, Cosmic CVE-2019-6778 CVE-2019-3812 CVE-2018-20216 CVE-2018-20191 CVE-2018-20126 CVE-2018-20125 CVE-2018-20124 CVE-2018-20123 CVE-2018-19489 CVE-2018-16872 CVE-2018-16867 Heap-based buffer overflow in TCP emulation OOB read in i2c handling allowing a local attacker within a guest who has permission to execute i2c commands could read qemu host process stack memory Plan9 FS host-directory sharing race-condition on file rename -> crash -> DoS 2 issues in USB MTP handling: time-of-check to time-of-use error allows attacker with write access to the shared host filesystem can use this to navigate host FS in context of QEMU host process and read any therefore read any file which QEMU can on the host Path traversal flaw due to improper filename sanitisation - allow to read-write arbitrary host files -> Dos or code execution on the host Updates for Paravirtualised RDMA subsystem: DoS due to infinite loop NULL pointer dereference due to missing read method Fix various memory leaks Various other NULL pointer dereferences plus a failure to check parameters leading to possible extreme memory allocation Fix OOB read triggerable by guest [USN-3924-1] mod_auth_mellon vulnerabilities 2 CVEs addressed in Bionic, Cosmic CVE-2019-3878 CVE-2019-3877 Apache module to provide authentication and authorisation via SAML 2.0 IdP Possible to bypass authorisation checks when also using mod_proxy Fix an open-redirect via the logout endpoint - could encode an absolute URL using backward-slashes (\) in place of forward-slashes (/) and this would be propagated by the endpoint to the client where the browser would convert these and follow the redirect - due to mismatch in how browsers will convert these but apache’s own internal URI parsing does not [USN-3925-1] FreeImage vulnerability 1 CVEs addressed in Trusty, Xenial CVE-2016-5684 OOB write in XMP image handling - code execution [USN-3926-1] GPAC vulnerabilities 8 CVEs addressed in Xenial, Bionic, Cosmic CVE-2018-7752 CVE-2018-20763 CVE-2018-20762 CVE-2018-20761 CVE-2018-20760 CVE-2018-13006 CVE-2018-13005 CVE-2018-1000100 Various memory safety issues, including OOB buffer reads and writes due to missing bounds checks (was using strcpy without checking lengths…) Goings on in Ubuntu Security Community Joe McManus on Facebook insecure password storage https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://newsroom.fb.com/news/2019/03/keeping-passwords-secure/ Ubuntu Hardening Tips Paul Waring got in touch to mention his tips for hardening new Ubuntu installations: Install and configure unattended-upgrades Install UFW and block all incoming connections except specific services Can be done easily via ansible from just a few lines of YAML For servers: Install SSHGuard to ban IP addresses with too many failed login attempts Require TLS for all services via LetsEncrypt + certbot Configure SSH to permit only key-based authentication For wordpress installations - install wp-cli to auto-update themes and plugins Automate as much of this as possible for automatic hardening Hiring Ubuntu Security Generalist https://boards.greenhouse.io/canonical/jobs/1548812 Robotics Security Engineer https://boards.greenhouse.io/canonical/jobs/1550997 Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network @ubuntu_sec on twitter

Full show notes at the publisher

Episode 25 Mar 25, 2019

Show notes

Overview

Ghostscript is back to haunt us for another week, plus we look at vulnerabilities in ntfs-3g, snapd, firefox and more.

This week in Ubuntu Security Updates

39 unique CVEs addressed

[USN-3911-1] file vulnerabilities

4 CVEs addressed in Xenial, Bionic, Cosmic
4 DoS (crash) found via fuzzing:
- Stack overflow in readelf
- 2 different OOB read due to failure to NULL terminate a string before processing it
- Read past end of stack due to failing to properly keep track of buffer sizes

[USN-3906-2] LibTIFF vulnerabilities

8 CVEs addressed in Precise ESM
Covered in Episode 18 and Episode 24 for standard Ubuntu releases (not all CVEs covered in those updates applicable to Precise ESM)

[USN-3912-1] GDK-PixBuf vulnerability

1 CVEs addressed in Xenial
- CVE-2017-12447
Failure to properly validate BMP image palette parameters - leading to OOB when decoding colormap later on

[USN-3914-1] NTFS-3G vulnerability

1 CVEs addressed in Xenial, Bionic, Cosmic
- CVE-2019-9755
Discovered recently by Chris Coulson during code-audit of ntfs-3g - actually had been fixed upstream late last year but no CVE assigned
Heap buffer overflow able to be triggered when mounting a filesystem onto a mount point with path name greater than PATH_MAX, and from a current working directory which has a path name also greater than PATH_MAX
Contents of buffers is attacker controlled so heap can be overflown with attacker controlled input - likely to leverage into arbitrary code execution
Contrived example BUT in Debian and Ubuntu ntfs-3g is setuid root - which then leads to root privilege escalation with arbitrary code execution
Update was released within hours of the bug being made public to fix the heap buffer overflow
Currently testing ntfs-3g as not-setuid root to release in a future update to avoid any other possible privilege escalation bugs in the future

[USN-3915-1] Ghostscript vulnerabilities

2 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
- CVE-2019-3838
- CVE-2019-3835
Similar to previous CVE, forceput operator could be extracted from the DefineResource method to allow access to the file-system outside of the -dSAFER sandbox
superexec operator was available in the internal dictionary - also able to be extracted and hence used to access files outside the sandbox

[USN-3913-1] P7ZIP vulnerabilities

2 CVEs addressed in Xenial
- CVE-2017-17969
- CVE-2016-2335
Heap based OOB write when decompressing a crafted ZIP file (crash -> DoS, possible code execution)
Heap based OOB read when decompressing a UDF file (universal disk format - used for DVD images) - crash, DoS

[USN-3918-1] Firefox vulnerabilities

17 CVEs addressed in Xenial, Bionic, Cosmic
Almost latest Firefox release (this is 66, 66.0.1 was released Friday after Pwn2Own last week so expect another Firefox update today or tomorrow)
- Multiple memory safety issues fixed, possible code execution as a result
- 3 issues in FTP modal dialogs allow to either DoS user via successive dialogs, or conduct social engineering attacks against the user
- Possible information leak from parent to child process via IPC channels
- Various UAFs, type-confusion etc -> memory corruption -> possible code execution
- Incorrect bounds checking on JS objects IF Spectre mitigations disabled (these are enabled by default so user would have to explicitly disable them)
- and more…

[USN-3917-1] snapd vulnerability

1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
- CVE-2019-7303
Jann Horn reported the seccomp blacklist for TIOCSTI can be bypassed
snapd creates a seccomp filter for each snap which is designed to block TIOCSTI (as this can be used to fake input to other processes outside of the sandbox)
This is a 32-bit value to the ioctl system call, but on 64-bit architectures the kernel does this comparison as a 64-bit integer - so can be circumvented by using a 64-bit value to ioctl systemcall which has other bits set in the upper 32 bits - since when seccomp does comparison it uses the full 64 bits - so it won’t match the 32-bit value of TIOCSTI and so will be allowed - but then when used as the ioctl() argument it will correctly be truncated to 32-bits and the ioctl will proceed
Fixed in snapd to add a second seccomp filter to disallow anything in the upper 32-bits
Initially seemed like a kernel or libseccomp issue but both currently document this as a limitation already so treated in the end as a vulnerability in snapd

[USN-3916-1] libsolv vulnerabilities

3 CVEs addressed in Cosmic
Dependency solver used by packaging systems to resolve dependencies between packages etc
2 NULL pointer dereferences and 1 invalid memory read due to mishandling of variable length function arguments - all crash -> DoS

Goings on in Ubuntu Security Community

Hiring

Ubuntu Security Generalist

https://boards.greenhouse.io/canonical/jobs/1548812

Robotics Security Engineer

https://boards.greenhouse.io/canonical/jobs/1550997

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
@ubuntu_sec on twitter

Episode 24 Mar 19, 2019

Show notes

Overview

A look at recent fixes for vulnerabilities in poppler, WALinuxAgent, the Linux kernel and more. We also talk about some listener feedback on Ubuntu hardening and the launch of Ubuntu 14.04 ESM.

This week in Ubuntu Security Updates

18 unique CVEs addressed

[USN-3905-1] poppler vulnerability

1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
- CVE-2019-9200
Heap-based buffer underwrite (index into array using negative index) - write into heap memory which preceeds the intended buffer - heap corruption - crash -> DoS, possible code execution
Found by fuzzing and AddressSanitizer in clang

[USN-3906-1] LibTIFF vulnerabilities

6 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
All DoS, one possible code-execution:
- Dereference of an invalid address (read from invalid memory location)
- Heap buffer overread
- 2x NULL pointer dereferences
- Memory leak
- Heap buffer overflow - possible code execution

[USN-3907-1] WALinuxAgent vulnerability

1 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
- CVE-2019-0804
WALinuxAgent used to manage instances of Ubuntu (and other Linux distributions) running on Azure
Can be used to configure swap space for a given image
- would then create a swap file (/mnt/swapfile) BUT would make it world-readable
- so any local user could read it - if keys or other sensitive items were in memory that got swapped to disk could be read by all
Fixed to make this readable only by root and to also correct the permissions on any existing swapfile as well

[USN-3902-2] PHP vulnerabilities

4 CVEs addressed in Precise ESM
See last week’s Episode 23 - discussed for Xenial and Trusty - fixed now for Precise ESM as well

[USN-3910-1, USN-3910-2] Linux kernel vulnerabilities

5 CVEs addressed in Xenial and Trusty (Xenial HWE)
2 of these discussed in previous episodes Episode 23 (PolicyKit start time, DoS via mmaping a FUSE-backed file into processes memory containing command-line args)
Trigger of BUG_ON() in kernel (like assert() for kernel code) due to integer overflow from large pgoff parameter to remap_file_pages() when used in conjuction with an existing mmap() -> crash -> DoS
OOB read in USB driver for Option High Speed mobile devices - would read a descriptor from the USB device as a u8 and then index into an array with this without checking whether it fell within the array
NULL pointer dereference in f2fs driver via use of noflush_merge mount option

[USN-3908-1, USN-3908-2] Linux kernel vulnerability

1 CVEs addressed in Trusty and Precise ESM (Trusty HWE)
- CVE-2019-6133
See last week’s Episode 23 - discussed for Bionic kernel - now for Trusty kernel (and the Trusty HWE kernel backported to Precise ESM)
- PolicyKit start time issue, fixed in kernel

[USN-3909-1] libvirt vulnerability

1 CVEs addressed in Xenial, Bionic, Cosmic
- CVE-2019-3840
NULL pointer dereference in libvirt if agent does not reply in time (say guest is being shutdown) - crash host libvirt -> DoS

Goings on in Ubuntu Security Community

Ubuntu Hardening Response

Alexander Popov
- Responsible for getting STACKLEAK into the mainline kernel
- Pointed out his Linux Kernel Defence Map and kconfig hardened check
- We use kconfig hardened check internall and tyhicks has contributed various improvements which allow this to be used to check the various Ubuntu kernel configurations

Extended Security Maintenance for Ubuntu 14.04 (Trusty Tahr) begins April 25 2019

https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-March/004800.html
Ubuntu 14.04 LTS will transition to Extended Security Maintenance on Tuesday 25th April
Encourage users to upgrade to Xenial (and then Bionic)
ESM for 14.04 provided to customers via Ubuntu Advantage
Further details regarding ESM

Our TOPPODCAST Picks

Follow Us

Stay Connected

Overview

This week in Ubuntu Security Updates

[USN-3977-2] Intel Microcode update

[USN-3989-1] LibRaw vulnerabilities

[USN-3990-1] urllib3 vulnerabilities

[USN-3991-1] Firefox vulnerabilities

[USN-3566-2] PHP vulnerabilities

[USN-3992-1] WebKitGTK+ vulnerabilities

[USN-3993-1, USN-3993-2] curl vulnerabilities

[USN-3957-2] MariaDB vulnerabilities

Goings on in Ubuntu Security Community

Clarifications to documentation regarding latest Intel MDS vulnerabilities

Security Team plans for 19.10 development cycle

Hiring

Robotics Security Engineer

Security Certifications Engineer

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-3966-1] GNOME Shell vulnerability

[USN-3965-1] aria2 vulnerability

[USN-3967-1] FFmpeg vulnerabilities

[USN-3968-1] Sudo vulnerabilities

[USN-3969-1, USN-3969-2] wpa_supplicant and hostapd vulnerability

[USN-3970-1] Ghostscript vulnerability

[USN-3971-1] Monit vulnerabilities

[USN-3956-2] Bind vulnerability

Discussion with Joe McManus about malicious DockerHub images and Git repo takeover ransoms

Goings on in Ubuntu Security Community

Robotics Security Engineer

Security Certifications Engineer

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-3957-1] MySQL vulnerabilities

[USN-3958-1] GStreamer Base Plugins vulnerability

[USN-3959-1] Evince vulnerability

[USN-3960-1] WavPack vulnerability

[USN-3961-1] Dovecot vulnerabilities

[USN-3962-1] libpng vulnerability

[USN-3963-1] Memcached vulnerability

[USN-3953-2] PHP vulnerabilities

[USN-3964-1] python-gnupg vulnerabilities

Discussion with Joe McManus about another IoT compromise and DockerHub

Goings on in Ubuntu Security Community

Hiring

Robotics Security Engineer

Get in contact

Overview

These past two weeks in Ubuntu Security Updates

[USN-3947-1, USN-3947-2] Libxslt vulnerability

[USN-3948-1] WebKitGTK+ vulnerabilities

[USN-3949-1] OpenJDK 11 vulnerability

[USN-3918-4] Firefox regressions

[USN-3914-2] NTFS-3G update

[USN-3950-1] ZNC vulnerability

[USN-3951-1] Dovecot vulnerability

[USN-3952-1] Pacemaker vulnerabilities

[USN-3953-1] PHP vulnerabilities

[USN-3922-2, USN-3922-3] PHP vulnerabilities

[USN-3936-2] AdvanceCOMP vulnerability

[USN-3954-1] FreeRADIUS vulnerabilities

[USN-3955-1] tcpflow vulnerabilities

[USN-3956-1] Bind vulnerability

IoT Security follow-up with Joe McManus

Goings on in Ubuntu Security Community

Ubuntu 19.04 Disco Dingo Released

Ubuntu 14.04 Trusty Tahr transitions to Extended Security Maintenance

Hiring

Ubuntu Security Generalist

Robotics Security Engineer

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-3939-1, USN-3939-2] Samba vulnerability

[USN-3940-1, USN-3940-2] ClamAV vulnerabilities