Sign up to save your podcasts
Or
Share Episode 172
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 172
Overview
Finally, Ubuntu 22.04.1 LTS is released and we look at how best to upgrade,
plus we cover security updates for NVIDIA graphics drivers, OpenJDK,
Django, libxml, the Linux kernel and more.
This week in Ubuntu Security Updates
52 unique CVEs addressed
[USN-5547-1] NVIDIA graphics drivers vulnerabilities [00:43]
corruption since apparently could also DoS, perform data tampering and
info leaks
user with basic capabilities” -> DoS
is a system wide power controller which manages CPU and GPU power basd on
overall system workload to get best system performance per watt -
according to upstream documentation. Is only active when on AC power.
any process to communicate with the nvidia-powerd server and hence to
perform privileged actions through it
[USN-5546-1, USN-5546-2] OpenJDK vulnerabilities [03:09]
upstream advisory as an “easily exploitable vuln”, where an attacker
could forge certain SSL certificates (ie ones using ECDSA signatures) and
hence allow them to intercept or modify communications without being
detected.
provided signature values were not zero - a signature consists of two
values, r and s and these are used to then perform a bunch of
calculations to check it is valid - this involves comparing r against r
multiplied by a value derived from s - so if r and s are both zero you
effectively check 0 = 0
SAML assertions, WedAuthn messages etc
native Java (previously was C++ which was not vulnerable) for Java 15 -
so for Ubuntu this is openjdk-17 only which is not the default JRE
(openjdk-11 is)
[USN-5549-1] Django vulnerability [06:16]
BH Euroe in 2014 - causes a web application to “virtually” download a file from a
trusted domain - which then can get executed since is trusted
attacker can craft header content to get reflected into the response
body - this is then the contents for a file, as well as get some content
injected in the resulting filename - and then cause the response to be
downloaded which will
header of a FileResponse object based on a filename which is derived from
user input - fixed to escape the filename so can’t then inject content
into the Content-Disposition header
[USN-5550-1] GnuTLS vulnerabilities [07:55]
signatures -> DoS / RCE
[USN-5551-1] mod-wsgi vulnerability [08:10]
it came from an untrusted proxy and hence could allow unintended access
to services
[USN-5548-1] libxml2 vulnerability [08:32]
escape server-side includes
offending commit which introduced the vuln was reverted ~2 years ago
different CVEs in other XML/HTML parsing and sanitization libraries for
the same type of issue - but in this case was ignored and no CVE assigned
until now
[USN-5552-1] phpLiteAdmin vulnerability [11:29]
[USN-5553-1] libjpeg-turbo vulnerabilities [11:42]
decompression leading to very large memory usage -> DoS
[USN-5554-1] GDK-PixBuf vulnerability [12:06]
particularly on 32-bit platforms
[USN-5555-1] GStreamer Good Plugins vulnerabilities [12:29]
video codec handlers -> DoS / RCE
[USN-5558-1] libcdio vulnerabilities [13:00]
heap buffer over-read and NULL pointer dereference -> DoS
[USN-5557-1] Linux kernel vulnerabilities [13:44]
removed would still be referred to by other data structures and then
allow a user to trigger access to this -> DoS / RCE
nft set in another table -> UAF
[USN-5560-1, USN-5560-2] Linux kernel vulnerabilities [14:37]
[USN-5561-1] GNOME Web vulnerabilities [14:58]
gets ellipsised but UTF-8 length of ellipsis is not properly counted so
then overflows bounds -> DoS/RCE
[USN-5559-1] Moment.js vulnerabilities [15:40]
string to switch the locale which would then result in reading arbitrary
local files
dates - in particular rfc2822 formats which are tried by default - ReDoS
-> very large input could result in significant CPU-based DoS
Goings on in Ubuntu Security Community
Ubuntu 22.04.1 LTS released [16:43]
22.04 LTS release so far - if you are already running 22.04 LTS you don’t
have to do anything to get this- just make sure you have been installing
updates 😉
https://discourse.ubuntu.com/t/jammy-jellyfish-point-release-changes/29835
upgrade to 22.04 - I definitely recommend to upgrade, and to make the
process as smooth as possible, do it from a virtual terminal
terminal running directly on a console - no graphical environment
there is less chance that something may crash during the upgrade
process - since libraries get swapped out from underneath various
running processes etc
chooser log in screen hit CTRL + ALT + F2
username and password, then you can start the upgrade process by running
sudo do-release-upgrade
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
Finally, Ubuntu 22.04.1 LTS is released and we look at how best to upgrade,
plus we cover security updates for NVIDIA graphics drivers, OpenJDK,
Django, libxml, the Linux kernel and more.
This week in Ubuntu Security Updates
52 unique CVEs addressed
[USN-5547-1] NVIDIA graphics drivers vulnerabilities [00:43]
corruption since apparently could also DoS, perform data tampering and
info leaks
user with basic capabilities” -> DoS
is a system wide power controller which manages CPU and GPU power basd on
overall system workload to get best system performance per watt -
according to upstream documentation. Is only active when on AC power.
any process to communicate with the nvidia-powerd server and hence to
perform privileged actions through it
[USN-5546-1, USN-5546-2] OpenJDK vulnerabilities [03:09]
upstream advisory as an “easily exploitable vuln”, where an attacker
could forge certain SSL certificates (ie ones using ECDSA signatures) and
hence allow them to intercept or modify communications without being
detected.
provided signature values were not zero - a signature consists of two
values, r and s and these are used to then perform a bunch of
calculations to check it is valid - this involves comparing r against r
multiplied by a value derived from s - so if r and s are both zero you
effectively check 0 = 0
SAML assertions, WedAuthn messages etc
native Java (previously was C++ which was not vulnerable) for Java 15 -
so for Ubuntu this is openjdk-17 only which is not the default JRE
(openjdk-11 is)
[USN-5549-1] Django vulnerability [06:16]
BH Euroe in 2014 - causes a web application to “virtually” download a file from a
trusted domain - which then can get executed since is trusted
attacker can craft header content to get reflected into the response
body - this is then the contents for a file, as well as get some content
injected in the resulting filename - and then cause the response to be
downloaded which will
header of a FileResponse object based on a filename which is derived from
user input - fixed to escape the filename so can’t then inject content
into the Content-Disposition header
[USN-5550-1] GnuTLS vulnerabilities [07:55]
signatures -> DoS / RCE
[USN-5551-1] mod-wsgi vulnerability [08:10]
it came from an untrusted proxy and hence could allow unintended access
to services
[USN-5548-1] libxml2 vulnerability [08:32]
escape server-side includes
offending commit which introduced the vuln was reverted ~2 years ago
different CVEs in other XML/HTML parsing and sanitization libraries for
the same type of issue - but in this case was ignored and no CVE assigned
until now
[USN-5552-1] phpLiteAdmin vulnerability [11:29]
[USN-5553-1] libjpeg-turbo vulnerabilities [11:42]
decompression leading to very large memory usage -> DoS
[USN-5554-1] GDK-PixBuf vulnerability [12:06]
particularly on 32-bit platforms
[USN-5555-1] GStreamer Good Plugins vulnerabilities [12:29]
video codec handlers -> DoS / RCE
[USN-5558-1] libcdio vulnerabilities [13:00]
heap buffer over-read and NULL pointer dereference -> DoS
[USN-5557-1] Linux kernel vulnerabilities [13:44]
removed would still be referred to by other data structures and then
allow a user to trigger access to this -> DoS / RCE
nft set in another table -> UAF
[USN-5560-1, USN-5560-2] Linux kernel vulnerabilities [14:37]
[USN-5561-1] GNOME Web vulnerabilities [14:58]
gets ellipsised but UTF-8 length of ellipsis is not properly counted so
then overflows bounds -> DoS/RCE
[USN-5559-1] Moment.js vulnerabilities [15:40]
string to switch the locale which would then result in reading arbitrary
local files
dates - in particular rfc2822 formats which are tried by default - ReDoS
-> very large input could result in significant CPU-based DoS
Goings on in Ubuntu Security Community
Ubuntu 22.04.1 LTS released [16:43]
22.04 LTS release so far - if you are already running 22.04 LTS you don’t
have to do anything to get this- just make sure you have been installing
updates 😉
https://discourse.ubuntu.com/t/jammy-jellyfish-point-release-changes/29835
upgrade to 22.04 - I definitely recommend to upgrade, and to make the
process as smooth as possible, do it from a virtual terminal
terminal running directly on a console - no graphical environment
there is less chance that something may crash during the upgrade
process - since libraries get swapped out from underneath various
running processes etc
chooser log in screen hit CTRL + ALT + F2
username and password, then you can start the upgrade process by running
sudo do-release-upgrade
Get in contact