Ubuntu Security Podcast

Episode 191

Listen Later
Overview

This week saw the unexpected release of Ubuntu 20.04.6 so we go into the detail

behind that, plus we talk Everything Open and we cover security updates
including Emacs, LibreCAD, Python, vim and more.

This week in Ubuntu Security Updates

82 unique CVEs addressed

[USN-5955-1] Emacs vulnerability [00:50]
  • 1 CVEs addressed in Xenial ESM (16.04 ESM)
    • CVE-2022-48339
    • htmlfontify package would try and validate whether a given file is text by
      • calling file on it - but would fail to escape the filename - so if a user
      could be tricked into running htmlfontify-copy-and-link-dir on a crafted
      directory, could get code execution in the context of emacs
    • Unlikely to be an issue in practice, also there doesn’t appear to be any users
      • of this function on github (other than references to the documentation for it)
      [USN-5956-1, USN-5956-2] PHPMailer vulnerabilities [02:03]
      • 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
        • CVE-2021-3603
        • CVE-2020-13625
        • CVE-2018-19296
        • CVE-2017-5223
        • CVE-2017-11503
        • CVE-2016-10045
        • CVE-2016-10033
        • email sending library for PHP
        • similarly, possible RCE since could possibly inject commands that would be
          • passed to the shell when executing the underlying mail command - original
          patch didn’t fix properly so second CVE was issued for the fix
          [USN-5957-1] LibreCAD vulnerabilities [02:58]
          • 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
            • CVE-2021-45343
            • CVE-2021-45342
            • CVE-2021-45341
            • CVE-2021-21900
            • CVE-2021-21899
            • CVE-2021-21898
            • CVE-2018-19105
            • Various memory corruption issues when parsing DXF, DWG, DRW or JWW files
              • OOB writes, UAFs, NULL ptr deref - RCE / DoS
                • [USN-5855-2] ImageMagick vulnerabilities [03:37]
                • 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
                  • CVE-2022-44268
                  • CVE-2022-44267
                    • [USN-5958-1] FFmpeg vulnerabilities [03:45]
                    • 4 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
                      • CVE-2022-3965
                      • CVE-2022-3964
                      • CVE-2022-3341
                      • CVE-2022-3109
                      • 2 NULL ptr derefs and 2 OOB reads -> DoS
                        • [USN-5954-1] Firefox vulnerabilities [03:59]
                        • 9 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
                          • CVE-2023-28161
                          • CVE-2023-28164
                          • CVE-2023-28160
                          • CVE-2023-25751
                          • CVE-2023-28177
                          • CVE-2023-28176
                          • CVE-2023-28162
                          • CVE-2023-25752
                          • CVE-2023-25750
                          • 111.0
                            • usual mix of issues for web engines (DoS, info leak across domains, RCE) if
                              • visited a malicious website
                            • memory corruption, plus a few logic issues that could be used to either
                              • cause firefox to leak local information back to the web server or spoof
                              parts of the UI etc
                              [USN-5961-1] abcm2ps vulnerabilities
                              • 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
                                • CVE-2021-32436
                                • CVE-2021-32435
                                • CVE-2021-32434
                                • CVE-2019-1010069
                                • CVE-2018-10771
                                • CVE-2018-10753
                                  • [USN-5962-1] Linux kernel (Intel IoTG) vulnerabilities [04:47]
                                  • 18 CVEs addressed in Jammy (22.04 LTS)
                                    • CVE-2023-26605
                                    • CVE-2023-0468
                                    • CVE-2022-47521
                                    • CVE-2022-47520
                                    • CVE-2022-47519
                                    • CVE-2022-47518
                                    • CVE-2022-45869
                                    • CVE-2022-4379
                                    • CVE-2022-42329
                                    • CVE-2022-42328
                                    • CVE-2022-4139
                                    • CVE-2022-3545
                                    • CVE-2022-3521
                                    • CVE-2022-3435
                                    • CVE-2022-3344
                                    • CVE-2022-3169
                                    • CVE-2023-0179
                                    • CVE-2023-0461
                                    • two high priority issues
                                      • netfilter mishandling of vlan headers - OOB write -> crash / RCE
                                      • UAF in upper-level protocol subsystem - can be triggered by local user -
                                        • similarly, crash / RCE
                                        [USN-5959-1] Kerberos vulnerabilities [05:32]
                                        • 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
                                          • CVE-2021-37750
                                          • CVE-2021-36222
                                          • NULL ptr derefs -> crash in kerberos daemon -> DoS
                                            • [USN-5960-1] Python vulnerability [05:51]
                                            • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
                                              • CVE-2023-24329
                                              • possibly to bypass blocklists in urllib.parse() simply by prefixing the URL
                                                • with a space - blocklisting is not part of upstream functionality but often
                                                would be implemented in application / library logic by first using urlparse()
                                                to parse the given URL - if prefixed with a space then can get urlparse() to
                                                fail to return the correct scheme/hostname - can workaround simply by first
                                                calling strip() on URL - apparently upstream still discussing whether the
                                                current fix is sufficient so watch this space
                                                [USN-5963-1] Vim vulnerabilities [07:14]
                                                • 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
                                                  • CVE-2023-1264
                                                  • CVE-2023-1175
                                                  • CVE-2023-1170
                                                  • CVE-2023-0051
                                                  • CVE-2023-0433
                                                  • CVE-2023-0288
                                                  • CVE-2023-0054
                                                  • CVE-2023-0049
                                                  • CVE-2022-47024
                                                  • moar vim vulns from bug-bounty - all found via fuzzing of vim - all memory
                                                    • corruption vulns -> DoS / RCE
                                                    [USN-5964-1] curl vulnerabilities [07:41]
                                                    • 5 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
                                                      • CVE-2023-27538
                                                      • CVE-2023-27536
                                                      • CVE-2023-27535
                                                      • CVE-2023-27534
                                                      • CVE-2023-27533
                                                      • various connection reuse issues - eg. would reuse an SSH connection even if
                                                        • caller had changed an SSH option - similar for FTP.
                                                      • mishandling of ~ in SFTP could then allow access to unintended files (would
                                                        • expand even if not the first part of the path)
                                                        [USN-5806-3] Ruby vulnerability [08:43]
                                                        • 1 CVEs addressed in Focal (20.04 LTS)
                                                          • CVE-2021-33621
                                                            • [USN-5965-1] TigerVNC vulnerability [08:53]
                                                            • 1 CVEs addressed in Focal (20.04 LTS)
                                                              • CVE-2020-26117
                                                              • when processing a TLS certificate, would store that internally as a
                                                                • certificate authority - then if client connected to a different server would
                                                                use that stored cert as a CA cert to validate the new server - could then
                                                                allow a malicious server to impersonate other servers
                                                                [USN-5904-2] SoX regression [09:35]
                                                                • 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
                                                                  • CVE-2022-31651
                                                                  • CVE-2022-31650
                                                                  • CVE-2021-40426
                                                                  • CVE-2021-3643
                                                                  • CVE-2021-23210
                                                                  • CVE-2021-23172
                                                                  • CVE-2021-23159
                                                                  • CVE-2019-13590
                                                                  • CVE-2021-33844
                                                                  • Fix for one of the vulns fixed in the original update was incomplete
                                                                    • Goings on in Ubuntu Security Community
                                                                    Ubuntu 20.04.6 LTS Released [09:49]
                                                                    • https://lists.ubuntu.com/archives/ubuntu-announce/2023-March/000287.html
                                                                    • https://wiki.ubuntu.com/FocalFossa/ReleaseSchedule
                                                                    • Wasn’t originally planned to be released

                                                                      • Unlike previous point releases, 20.04.6 is a refresh of the amd64

                                                                      installer media after recent key revocations, re-enabling their usage
                                                                      on Secure Boot enabled systems.

                                                                      Many other security updates for additional high-impact bug fixes are also

                                                                      included, with a focus on maintaining stability and compatibility with
                                                                      Ubuntu 20.04 LTS.

                                                                      • TL;DR - recent vulnerabilities in shim and grub meant that we revoked those
                                                                        • old versions such that they would not boot anymore if updates had been
                                                                        installed - so if wanted to reinstall using the 20.04.5 media it would fail to
                                                                        boot. Can prove this to yourself:
                                                                        cat /sys/firmware/efi/efivars/SbatLevelRT-605dab50-e046-4300-abb6-3dd810dd8b23
                                                                        sbat,1,2022052400
                                                                        grub,2
                                                                        objdump -j .sbat -s grubx64.efi
                                                                        Ubuntu Security at Everything Open 2023 [12:02]
                                                                        • https://ubuntu.com/blog/everything-open-2023-in-melbourne
                                                                        • https://2023.everythingopen.au/schedule/presentation/64/
                                                                        • Presented about how the Ubuntu Security keeps Ubuntu secure and also gave
                                                                          • advice on how you can improve the security of your own open source projects
                                                                          Get in contact
                                                                          • [email protected]
                                                                          • #ubuntu-security on the Libera.Chat IRC network
                                                                          • ubuntu-hardened mailing list
                                                                          • Security section on discourse.ubuntu.com
                                                                          • @[email protected], @ubuntu_sec on twitter
                                                                            • ...more
                                                                            View all episodesView all episodes
                                                                            Download on the App Store
                                                                            Ubuntu Security PodcastBy Ubuntu Security Team
                                                                            • 4.8
                                                                            • 4.8
                                                                            • 4.8
                                                                            • 4.8
                                                                            • 4.8

                                                                            4.8

                                                                            10 ratings