Ubuntu Security Podcast

Episode 139

Listen Later
Overview

This week we put out a call for testing and feedback on proposed Samba

updates for Ubuntu 18.04 LTS plus we look at security updates for Mailman,
Thunderbird, LibreOffice, BlueZ and more.

This week in Ubuntu Security Updates

15 unique CVEs addressed

[USN-5150-1] OpenEXR vulnerability [00:39]
  • 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
    • CVE-2021-3941
    • oss-fuzz -> div-by-zero with crafted image using YUV-encoded colors
      • [USN-5151-1] Mailman vulnerabilities [00:58]
      • 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
        • CVE-2021-43332
        • CVE-2021-43331
        • Similar to vulns in last Mailman update (Episode 136)
          • [USN-5152-1] Thunderbird vulnerabilities [01:27]
          • 5 CVEs addressed in Impish (21.10)
            • CVE-2021-38509
            • CVE-2021-38507
            • CVE-2021-38506
            • CVE-2021-38504
            • CVE-2021-38503
            • 91.3.1
            • Usual web framework issues (HTML email etc) - one TB specific issue
              • around the ability to force TB into full-screen via web content
              navigation - could then spoof usual chrome which is hidden in fullscreen
              and get user input unexpectedly
              [USN-5153-1] LibreOffice vulnerabilities [02:23]
              • 2 CVEs addressed in Focal (20.04 LTS)
                • CVE-2021-25634
                • CVE-2021-25633
                • 2 issues around interpretation / display of details for signed
                  • documents - could inject a new timestamp and get this shown as the time
                  the document was signed, or could cause to show incorrect details for a
                  signed document by adding details from another certificate
                • Too invasive to backport for 18.04 LTS
                  • [USN-5154-1] FreeRDP vulnerabilities [03:28]
                  • 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
                    • CVE-2021-41160
                    • CVE-2021-41159
                    • OOB write in client if sent malicious data from server -> crash / code-exec
                    • if using a gateway and the RPC protocol, would fail to validate input ->
                      • malicious gateway could then corrupt client memory -> crash / code-exec
                      [USN-5155-1] BlueZ vulnerabilities [04:07]
                      • 3 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
                        • CVE-2021-43400
                        • CVE-2021-41229
                        • CVE-2021-3658
                        • Would save and restore discoverable status on power down / power up - so
                          • if powered down when discoverable would power up as discoverable
                        • UAF if gatt client disconnected during a particular write operation with
                          • dbus - so would likely need bad luck or cooperation between a local
                          application / user and the device to trigger
                        • Memory leak in handling of SDP devices -> DoS
                          • Goings on in Ubuntu Security Community
                          Samba updates available for testing for Ubuntu 18.04 LTS [05:24]
                          • https://discourse.ubuntu.com/t/samba-update-for-ubuntu-18-04-lts-bionic/25408
                          • Episode 138 discussed difficulties in handling large security updates for
                            • ageing software
                          • Backport ~700 patches (with potential regressions) or backport newer
                            • version, possibly breaking things in the process due to new features /
                            changes in behaviour etc (plus incompatibilities with other software in
                            Ubuntu archive)
                          • Upstream released
                          • Contains fixes for the most severe CVEs from the most recent updates for
                            • Samba (USN-5142-1) - CVE-2016-2124, CVE-2020-25717, CVE-2020-25722,
                            CVE-2021-3671
                            Get in contact
                            • [email protected]
                            • #ubuntu-security on the Libera.Chat IRC network
                            • ubuntu-hardened mailing list
                            • Security section on discourse.ubuntu.com
                            • @ubuntu_sec on twitter
                              • ...more
                              View all episodesView all episodes
                              Download on the App Store
                              Ubuntu Security PodcastBy Ubuntu Security Team
                              • 4.8
                              • 4.8
                              • 4.8
                              • 4.8
                              • 4.8

                              4.8

                              10 ratings