Sign up to save your podcasts
Or
Share Episode 102
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 102
Overview
This week we discuss the recent high profile vulnerability found in
libcrypt 1.9.0, plus we look at updates for the Linux kernel, XStream,
Django, Apport and more.
This week in Ubuntu Security Updates
66 unique CVEs addressed
[USN-4705-2] Sudo vulnerability [00:48]
[USN-4708-1] Linux kernel vulnerabilities
[USN-4709-1] Linux kernel vulnerabilities
[USN-4710-1] Linux kernel vulnerability
[USN-4711-1] Linux kernel vulnerabilities
[USN-4712-1] Linux kernel regression
[USN-4713-1] Linux kernel vulnerability [01:31]
permissions of the requester and so could allow an attacker to access
backing stores to which they did not have permission. If using iSCSI,
this could then be exploited over the network to access other LUNs
etc. Also affected tcmu-runner which is the userspace daemon for handling
requests in userspace and can be used for HA setups etc.
[USN-4707-1] TCMU vulnerability [02:23]
[LSN-0074-1] Linux kernel vulnerability [02:40]
[USN-4706-1] Ceph vulnerabilities [02:55]
[USN-4714-1] XStream vulnerabilities [03:02]
commands
of the process which is using XStream)
[USN-4715-1, USN-4715-2] Django vulnerability [03:58]
with dot components - this is used with startapp or startproject via the
–template argument so can be exploited if using an attacker controlled
archive to bootstrap a new django app etc
[USN-4716-1] MySQL vulnerabilities [05:00]
LTS/18.04 LTS
[USN-4717-1] Firefox vulnerabilities [05:32]
[USN-4467-2] QEMU vulnerabilities [05:52]
14.04 ESM, now fixed there
[USN-4718-1] fastd vulnerability [06:12]
[USN-4719-1] ca-certificates update [06:28]
bundle
[USN-4720-1] Apport vulnerabilities [06:46]
info about the crashed process to prepare a crash report
cause Apport to misbehave and fail to drop privileges or possibly get
code execution - in this case, they found that Apport failed to properly
handle malformed contents in these files - fixed to parse them more
strictly
Goings on in Ubuntu Security Community
libgcrypt 1.9.0 0-day [08:32]
overwrite a structure on the heap which contains the buffer, followed by
a function pointer - so can relatively easily get code execution by
overwriting the function pointer to an attacker controlled function
(which could be in the initial buffer itself)
19th January this year and even current devel release of Ubuntu 21.04
only contains 1.8.7
release of anything, you get both the newest patches automatically BUT
you also get the 0-days since any unknown, unpatched vulns introduced in
new code will be present. However, if you run older releases, they won’t
have this newer code so won’t have 0-days but may have N-days if you
aren’t patching. Worst case is to run old software and never update it
since it has vulns that are unpatched and which have more time to have
been discovered and more time for exploits to have been developed
against it. Whereas if you run the latest code, there is less chance an
exploit exists for any new vulns / 0-days it may contain but it clearly
could have 0-days… Also if you are constantly upgrading to the latest
version that is a lot of churn and introduces the chance for feature
regressions and other breakage etc. So the best option then is to run a
known stable version and apply patches on top just for security
vulnerabilities - this is exactly the approach we take for Ubuntu :)
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
This week we discuss the recent high profile vulnerability found in
libcrypt 1.9.0, plus we look at updates for the Linux kernel, XStream,
Django, Apport and more.
This week in Ubuntu Security Updates
66 unique CVEs addressed
[USN-4705-2] Sudo vulnerability [00:48]
[USN-4708-1] Linux kernel vulnerabilities
[USN-4709-1] Linux kernel vulnerabilities
[USN-4710-1] Linux kernel vulnerability
[USN-4711-1] Linux kernel vulnerabilities
[USN-4712-1] Linux kernel regression
[USN-4713-1] Linux kernel vulnerability [01:31]
permissions of the requester and so could allow an attacker to access
backing stores to which they did not have permission. If using iSCSI,
this could then be exploited over the network to access other LUNs
etc. Also affected tcmu-runner which is the userspace daemon for handling
requests in userspace and can be used for HA setups etc.
[USN-4707-1] TCMU vulnerability [02:23]
[LSN-0074-1] Linux kernel vulnerability [02:40]
[USN-4706-1] Ceph vulnerabilities [02:55]
[USN-4714-1] XStream vulnerabilities [03:02]
commands
of the process which is using XStream)
[USN-4715-1, USN-4715-2] Django vulnerability [03:58]
with dot components - this is used with startapp or startproject via the
–template argument so can be exploited if using an attacker controlled
archive to bootstrap a new django app etc
[USN-4716-1] MySQL vulnerabilities [05:00]
LTS/18.04 LTS
[USN-4717-1] Firefox vulnerabilities [05:32]
[USN-4467-2] QEMU vulnerabilities [05:52]
14.04 ESM, now fixed there
[USN-4718-1] fastd vulnerability [06:12]
[USN-4719-1] ca-certificates update [06:28]
bundle
[USN-4720-1] Apport vulnerabilities [06:46]
info about the crashed process to prepare a crash report
cause Apport to misbehave and fail to drop privileges or possibly get
code execution - in this case, they found that Apport failed to properly
handle malformed contents in these files - fixed to parse them more
strictly
Goings on in Ubuntu Security Community
libgcrypt 1.9.0 0-day [08:32]
overwrite a structure on the heap which contains the buffer, followed by
a function pointer - so can relatively easily get code execution by
overwriting the function pointer to an attacker controlled function
(which could be in the initial buffer itself)
19th January this year and even current devel release of Ubuntu 21.04
only contains 1.8.7
release of anything, you get both the newest patches automatically BUT
you also get the 0-days since any unknown, unpatched vulns introduced in
new code will be present. However, if you run older releases, they won’t
have this newer code so won’t have 0-days but may have N-days if you
aren’t patching. Worst case is to run old software and never update it
since it has vulns that are unpatched and which have more time to have
been discovered and more time for exploits to have been developed
against it. Whereas if you run the latest code, there is less chance an
exploit exists for any new vulns / 0-days it may contain but it clearly
could have 0-days… Also if you are constantly upgrading to the latest
version that is a lot of churn and introduces the chance for feature
regressions and other breakage etc. So the best option then is to run a
known stable version and apply patches on top just for security
vulnerabilities - this is exactly the approach we take for Ubuntu :)
Get in contact