Sign up to save your podcasts
Or
Share Episode 194
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 194
Overview
The team are back from Prague and bring with them a new segment, drilling into
recent academic research in the cybersecurity space - for this inaugural segment
new team member Andrei looks at modelling of attacks against network intrusion
detections systems, plus we cover the week in security updates looking at
vulnerabilities in Django, Ruby, Linux kernel, Erlang, OpenStack and more.
This week in Ubuntu Security Updates
57 unique CVEs addressed
[USN-6054-1] Django vulnerability (00:55)
validation on the file
HTML attribute to the form - in this case though only the last file would be
validated - and so other files would escape validation
use these forms for multiple files and adds a new option to restore the old
behaviour if really desired - AND it adds support for validating all files in
this case.
[USN-6055-1] Ruby vulnerabilities (02:11)
is then validated by a regex which takes an inordinate amount of time to run
[USN-6055-2] Ruby regression (03:11)
under investigation and hope to fix it again in a future update
[USN-6056-1] Linux kernel (OEM) vulnerability (03:13)
[USN-6057-1] Linux kernel (Intel IoTG) vulnerabilities (03:31)
another - often used for things like schroots where you want to have the
pristine source and then a working session chroot where you can make changes
and then finally dispose of the whole thing back to the original
the suid bit is ignored - in this case, if had setup an overlay with the
base file-system mounted nosuid, then in some cases it would be possible to
copy up an suid binary as an unprivileged user and have it retain the suid
bit - and then the user could just execute it to gain root privileges
[USN-6058-1] Linux kernel vulnerability (05:45)
seems upstream is sick of these UAFs in TCINDEX so their fix simply removes
this classifier from the kernel and hence so does ours - in general we try not
to introduce breaking changes but in this case prefer to stay consistent with
upstream - also upstream say this does not have many known users anyway
[USN-6059-1] Erlang vulnerability (06:23)
certificate - basically a malicious client could send the certificate and then
simply omit the TLS handshake message which tells the server to validate the
cert and the server state would then show the cert had been validated
authentication (ie. the '{verify, verify_peer}' SSL option)
more complicated
[USN-6060-1, USN-6060-2] MySQL vulnerabilities (07:40)
new features / incompatible changes - full list of details from upstream:
[USN-6061-1] WebKitGTK vulnerabilities (08:14)
policy
[USN-6062-1] FreeType vulnerability (08:38)
the advent of web fonts)
[USN-6063-1] Ceph vulnerabilities (09:03)
[USN-6066-1] OpenStack Heat vulnerability (09:29)
[USN-6067-1] OpenStack Neutron vulnerabilities (09:39)
[USN-6068-1] Open vSwitch vulnerability (09:45)
IPv6 to specify hop-by-hop options) - if a packet with protocol 0 was
encountered, OVS would install a dataflow path for both kernel and userspace
which would match on ALL IP protocols for this flow - so this would then
possibly match against other IP packets and so cause them to be handled
incorrectly (possibly allowing when should have been denied etc)
[USN-6065-1] css-what vulnerabilities (10:43)
[USN-6064-1] SQL parse vulnerability (11:00)
Goings on in Ubuntu Security Community
Ubuntu 23.10 release cycle opens (11:41)
diving deep into various aspects like what kinds of tooling and processes we
want to try and improve across the team, talking about the culture and history
of the team to make sure we maintain our great culture as the team grows.
which go into Ubuntu Pro vs the regular Ubuntu Archive - making sure it is
clear to consumers of our USNs etc what is where, plus the various policies
around updated for Ubuntu Pro
plus how to coordinate better with the snapd team
and tackle some of that
unprivileged user namespaces within Ubuntu
customers alike
updates for packages that require particular hardware (think things like
intel-microcode, nvme-cli, various graphics drivers etc)
io_uring
introduction to these types of topics see
https://ubuntu.com/engage/introduction-to-confidential-computing-webinar)
Academic paper review with Andrei Iosif (14:40)
research papers
SecOps startup developing open source tools for automating various
cybersecurity solutions - brings a wide range of great experience to our team
Network Intrusion Detection Systems, with a particular focus on IDSs that are
based on AI/ML approaches)
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
The team are back from Prague and bring with them a new segment, drilling into
recent academic research in the cybersecurity space - for this inaugural segment
new team member Andrei looks at modelling of attacks against network intrusion
detections systems, plus we cover the week in security updates looking at
vulnerabilities in Django, Ruby, Linux kernel, Erlang, OpenStack and more.
This week in Ubuntu Security Updates
57 unique CVEs addressed
[USN-6054-1] Django vulnerability (00:55)
validation on the file
HTML attribute to the form - in this case though only the last file would be
validated - and so other files would escape validation
use these forms for multiple files and adds a new option to restore the old
behaviour if really desired - AND it adds support for validating all files in
this case.
[USN-6055-1] Ruby vulnerabilities (02:11)
is then validated by a regex which takes an inordinate amount of time to run
[USN-6055-2] Ruby regression (03:11)
under investigation and hope to fix it again in a future update
[USN-6056-1] Linux kernel (OEM) vulnerability (03:13)
[USN-6057-1] Linux kernel (Intel IoTG) vulnerabilities (03:31)
another - often used for things like schroots where you want to have the
pristine source and then a working session chroot where you can make changes
and then finally dispose of the whole thing back to the original
the suid bit is ignored - in this case, if had setup an overlay with the
base file-system mounted nosuid, then in some cases it would be possible to
copy up an suid binary as an unprivileged user and have it retain the suid
bit - and then the user could just execute it to gain root privileges
[USN-6058-1] Linux kernel vulnerability (05:45)
seems upstream is sick of these UAFs in TCINDEX so their fix simply removes
this classifier from the kernel and hence so does ours - in general we try not
to introduce breaking changes but in this case prefer to stay consistent with
upstream - also upstream say this does not have many known users anyway
[USN-6059-1] Erlang vulnerability (06:23)
certificate - basically a malicious client could send the certificate and then
simply omit the TLS handshake message which tells the server to validate the
cert and the server state would then show the cert had been validated
authentication (ie. the '{verify, verify_peer}' SSL option)
more complicated
[USN-6060-1, USN-6060-2] MySQL vulnerabilities (07:40)
new features / incompatible changes - full list of details from upstream:
[USN-6061-1] WebKitGTK vulnerabilities (08:14)
policy
[USN-6062-1] FreeType vulnerability (08:38)
the advent of web fonts)
[USN-6063-1] Ceph vulnerabilities (09:03)
[USN-6066-1] OpenStack Heat vulnerability (09:29)
[USN-6067-1] OpenStack Neutron vulnerabilities (09:39)
[USN-6068-1] Open vSwitch vulnerability (09:45)
IPv6 to specify hop-by-hop options) - if a packet with protocol 0 was
encountered, OVS would install a dataflow path for both kernel and userspace
which would match on ALL IP protocols for this flow - so this would then
possibly match against other IP packets and so cause them to be handled
incorrectly (possibly allowing when should have been denied etc)
[USN-6065-1] css-what vulnerabilities (10:43)
[USN-6064-1] SQL parse vulnerability (11:00)
Goings on in Ubuntu Security Community
Ubuntu 23.10 release cycle opens (11:41)
diving deep into various aspects like what kinds of tooling and processes we
want to try and improve across the team, talking about the culture and history
of the team to make sure we maintain our great culture as the team grows.
which go into Ubuntu Pro vs the regular Ubuntu Archive - making sure it is
clear to consumers of our USNs etc what is where, plus the various policies
around updated for Ubuntu Pro
plus how to coordinate better with the snapd team
and tackle some of that
unprivileged user namespaces within Ubuntu
customers alike
updates for packages that require particular hardware (think things like
intel-microcode, nvme-cli, various graphics drivers etc)
io_uring
introduction to these types of topics see
https://ubuntu.com/engage/introduction-to-confidential-computing-webinar)
Academic paper review with Andrei Iosif (14:40)
research papers
SecOps startup developing open source tools for automating various
cybersecurity solutions - brings a wide range of great experience to our team
Network Intrusion Detection Systems, with a particular focus on IDSs that are
based on AI/ML approaches)
Get in contact