Ubuntu Security Podcast

Episode 141

Listen Later
Overview

A preview of some things to come for the Ubuntu Security Podcast plus we

cover security updates for Samba, uriparser, libmodbus, MariaDB, Mailman
and more.

This week in Ubuntu Security Updates

38 unique CVEs addressed

[USN-5174-1] Samba vulnerabilities [00:58]
  • 4 CVEs addressed in Bionic (18.04 LTS)
    • CVE-2021-3671
    • CVE-2020-25722
    • CVE-2020-25717
    • CVE-2016-2124
    • Few weeks ago published Samba updates for a range of vulns - mentioned in
      • Episode 139 the difficulties involved in patching older Samba versions
      like 4.7.6 as used in Ubuntu 18.04 - backports of patches for the more
      severe vulnerabilities including the ability for authenticated attackers
      to escalate privileges to root on domain machines and others
      [USN-5142-2] Samba regressions [02:06]
      • 9 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
        • CVE-2021-3671
        • CVE-2021-3738
        • CVE-2021-23192
        • CVE-2020-25722
        • CVE-2020-25721
        • CVE-2020-25719
        • CVE-2020-25718
        • CVE-2020-25717
        • CVE-2016-2124
        • Original upstream patches caused a bunch of regressions - once upstream
          • subsequently fixed these, we then updated our backports to include those
          regression fixes
        • How soon to ship vuln fixes?
          • [USN-5171-1] Long Range ZIP vulnerabilities [03:22]
          • 9 CVEs addressed in Bionic (18.04 LTS)
            • CVE-2018-5786
            • CVE-2018-5747
            • CVE-2018-5650
            • CVE-2018-11496
            • CVE-2018-10685
            • CVE-2017-9929
            • CVE-2017-9928
            • CVE-2017-8846
            • CVE-2017-8844
            • Compression tool optimised to achieve better performance on larger files
            • Results of fuzzing by various researchers over time - AFL
            • 4 UAFs, 2 stack buffer overflows, 2 infinite loop, 1 heap buffer overflow
              • [USN-5172-1] uriparser vulnerabilities [03:56]
              • 4 CVEs addressed in Bionic (18.04 LTS)
                • CVE-2018-20721
                • CVE-2018-19200
                • CVE-2018-19199
                • CVE-2018-19198
                • More fuzzing results -> Google AutoFuzz - seems to manage oss-fuzz etc
                • OOB write, integer overflow, OOB read, NULL ptr deref
                  • [USN-5173-1] libmodbus vulnerabilities [04:36]
                  • 2 CVEs addressed in Bionic (18.04 LTS)
                    • CVE-2019-14463
                    • CVE-2019-14462
                    • 1 vuln originally - OOB read on certain input - patch for this however
                      • contained a typo which then introduced a second vuln on a subset of the
                      original input - second CVE assigned for that - both now fixed
                      [USN-5170-1] MariaDB vulnerability [05:13]
                      • 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
                        • CVE-2021-35604
                        • Latest upstream point releases:
                          • 10.5.13 -> 21.04, 21.10
                          • 10.3.32 -> 20.04
                          • As usual not much details on the vuln (MariaDB fork of MySQL, maintained
                            • by Oracle who don’t provide a lot of specific details in their
                            vulnerability reports)
                            [USN-5178-1] Django vulnerability [06:04]
                            • 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
                              • CVE-2021-44420
                              • Failed to handle URLs with embedded trailing newlines - newline would
                                • cause the URL to not match the existing URL path-based access controls so
                                could bypass those
                                [USN-5179-1] BusyBox vulnerabilities [06:33]
                                • 10 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
                                  • CVE-2021-42386
                                  • CVE-2021-42385
                                  • CVE-2021-42384
                                  • CVE-2021-42382
                                  • CVE-2021-42381
                                  • CVE-2021-42380
                                  • CVE-2021-42379
                                  • CVE-2021-42378
                                  • CVE-2021-42374
                                  • CVE-2021-28831
                                  • Busybox implements a lot of standard unix utilities in a single binary
                                  • UAF / OOB write when decompressing crafted gzip files
                                  • Heap OOB on when decompressing crafted lzma
                                  • Lots of UAFs in awk impl
                                    • [USN-5180-1] Mailman vulnerability [07:37]
                                    • 1 CVEs addressed in Bionic (18.04 LTS)
                                      • CVE-2021-44227
                                      • Wouldn’t validate that a CSRF token used for admin pages was actually
                                        • issued for that context - so a regular list user could take their own
                                        CSRF token, craft a URL for the admin user with this token and if the
                                        admin user visited that then they could evade the inteded CSRF
                                        protections - so could say change the admindb password etc
                                        [USN-5168-4] NSS regression [08:47]
                                        • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
                                          • CVE-2021-43527
                                          • Typo in backported patch could cause NSS to fail in some circumstances
                                            • and cause an SSL session to fail (DoS)
                                            Goings on in Ubuntu Security Community
                                            Preview of some upcoming content and changes [09:26]
                                            Get in contact
                                            • [email protected]
                                            • #ubuntu-security on the Libera.Chat IRC network
                                            • ubuntu-hardened mailing list
                                            • Security section on discourse.ubuntu.com
                                            • @ubuntu_sec on twitter
                                              • ...more
                                              View all episodesView all episodes
                                              Download on the App Store
                                              Ubuntu Security PodcastBy Ubuntu Security Team
                                              • 4.8
                                              • 4.8
                                              • 4.8
                                              • 4.8
                                              • 4.8

                                              4.8

                                              10 ratings