Sign up to save your podcasts
Or
Share Episode 179
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 179
Overview
Finer grained control for unprivileged user namespaces is on the horizon for
Ubuntu 22.10, plus we cover security updates for PCRE, etcd, OAuthLib, SoS,
Squid and more.
This week in Ubuntu Security Updates
37 unique CVEs addressed
[USN-5626-2] Bind vulnerabilities [00:40]
[USN-5627-1] PCRE vulnerabilities [01:01]
[USN-5628-1] etcd vulnerabilities [01:19]
transactions that have been committed but not yet applied to the main
database)
permissions for a directory that may already exist (info leak) and one in
setup of endpoints that could allow a DoS
[USN-5630-1, USN-5639-1] Linux kernel vulnerabilities [02:45]
[USN-5633-1, USN-5635-1, USN-5640-1, USN-5644-1] Linux kernel vulnerabilities [03:09]
[USN-5634-1] Linux kernel (OEM) vulnerability [03:23]
[USN-5632-1] OAuthLib vulnerability [03:40]
keystone, django, duplicity
exception -> application crash -> DoS
[USN-5631-1] libjpeg-turbo vulnerabilities [04:05]
heap buffer overflow, NULL pointer dereference, resource consumption based DoS
in cjpeg utility - crafted file with a valid Targa header but incomplete
data - would keep trying pixel after reaching EOF - internally used getc()
which returns the special value EOF when the end of file is reached - this is
actually -1 but requires the caller to check for this special value - if not,
would interpret this as pixel data (all bits set -> 255,255,255 -> white)
resulting in JPEG file that was possibly thousands of times bigger than the
input file - fixed to use existing input routines to read the data which
already check for EOF condition
[USN-5629-1] Python vulnerability [05:54]
beginning - a URI such as //path gets treated as an absolute URI rather than a
path - could then end up sending a 301 location header with a misleading target
only implements basic security checks
[USN-5636-1] SoS vulnerability [06:39]
could contain passwords - instead now looks for anything with the name
password and redacts that
[USN-5637-1] libvpx vulnerability [07:45]
[USN-5638-1] Expat vulnerability [07:55]
[USN-5641-1] Squid vulnerabilities [08:06]
read other client ids / credentials and internal network structure
for NTLM authentication - since this is in handling of credentials, could
allow an attacker to read decrypted user credentials or other memory regions
from Squid
[USN-5642-1] WebKitGTK vulnerabilities [08:57]
[USN-5643-1] Ghostscript vulnerabilities [09:18]
Goings on in Ubuntu Security Community
Ubuntu 22.10 (Kinetic Kudu) Beta Released [09:45]
release - if you do want to upgrade to the beta, and you are using 22.04
desktop, then first log out, switch to a virtual console (Ctrl-Alt-F2) and run
it from there as less chance that it takes down your whole graphical session
and hence the upgrade process partway through
Preview of planned unprivileged user namespace restrictions in Ubuntu 22.10 [11:05]
kernel vulns
sudo sysctl kernel.unprivileged_userns_clone=0
still use user namespaces but this then creates another attack surface - the
setuid-root binary
applications to use unprivileged user namespaces and then deny it to others
which have the userns permission would be allowed
confinement for things like bubblewrap etc that require this capability
policy that specifies the userns permission in apparmor package too
Ubuntu Security Podcast on break for 1 week
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
Finer grained control for unprivileged user namespaces is on the horizon for
Ubuntu 22.10, plus we cover security updates for PCRE, etcd, OAuthLib, SoS,
Squid and more.
This week in Ubuntu Security Updates
37 unique CVEs addressed
[USN-5626-2] Bind vulnerabilities [00:40]
[USN-5627-1] PCRE vulnerabilities [01:01]
[USN-5628-1] etcd vulnerabilities [01:19]
transactions that have been committed but not yet applied to the main
database)
permissions for a directory that may already exist (info leak) and one in
setup of endpoints that could allow a DoS
[USN-5630-1, USN-5639-1] Linux kernel vulnerabilities [02:45]
[USN-5633-1, USN-5635-1, USN-5640-1, USN-5644-1] Linux kernel vulnerabilities [03:09]
[USN-5634-1] Linux kernel (OEM) vulnerability [03:23]
[USN-5632-1] OAuthLib vulnerability [03:40]
keystone, django, duplicity
exception -> application crash -> DoS
[USN-5631-1] libjpeg-turbo vulnerabilities [04:05]
heap buffer overflow, NULL pointer dereference, resource consumption based DoS
in cjpeg utility - crafted file with a valid Targa header but incomplete
data - would keep trying pixel after reaching EOF - internally used getc()
which returns the special value EOF when the end of file is reached - this is
actually -1 but requires the caller to check for this special value - if not,
would interpret this as pixel data (all bits set -> 255,255,255 -> white)
resulting in JPEG file that was possibly thousands of times bigger than the
input file - fixed to use existing input routines to read the data which
already check for EOF condition
[USN-5629-1] Python vulnerability [05:54]
beginning - a URI such as //path gets treated as an absolute URI rather than a
path - could then end up sending a 301 location header with a misleading target
only implements basic security checks
[USN-5636-1] SoS vulnerability [06:39]
could contain passwords - instead now looks for anything with the name
password and redacts that
[USN-5637-1] libvpx vulnerability [07:45]
[USN-5638-1] Expat vulnerability [07:55]
[USN-5641-1] Squid vulnerabilities [08:06]
read other client ids / credentials and internal network structure
for NTLM authentication - since this is in handling of credentials, could
allow an attacker to read decrypted user credentials or other memory regions
from Squid
[USN-5642-1] WebKitGTK vulnerabilities [08:57]
[USN-5643-1] Ghostscript vulnerabilities [09:18]
Goings on in Ubuntu Security Community
Ubuntu 22.10 (Kinetic Kudu) Beta Released [09:45]
release - if you do want to upgrade to the beta, and you are using 22.04
desktop, then first log out, switch to a virtual console (Ctrl-Alt-F2) and run
it from there as less chance that it takes down your whole graphical session
and hence the upgrade process partway through
Preview of planned unprivileged user namespace restrictions in Ubuntu 22.10 [11:05]
kernel vulns
sudo sysctl kernel.unprivileged_userns_clone=0
still use user namespaces but this then creates another attack surface - the
setuid-root binary
applications to use unprivileged user namespaces and then deny it to others
which have the userns permission would be allowed
confinement for things like bubblewrap etc that require this capability
policy that specifies the userns permission in apparmor package too
Ubuntu Security Podcast on break for 1 week
Get in contact