Sign up to save your podcasts
Or
Share Episode 197
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 197
Overview
The venerable Ubuntu 18.04 LTS release has transitioned into ESM, plus we look
at Till Kamppeter’s excellent guide on how to set up your GitHub projects to
receive private vulnerability reports, and we cover the week in security updates
including PostgreSQL, Jhead, the Linux kernel, Linux PTP, snapd and a whole lot
more.
This week in Ubuntu Security Updates
56 unique CVEs addressed
[USN-6104-1] PostgreSQL vulnerabilities (00:55)
CREATE privileges - could then allow an auth user to execute arbitrary code as
a the bootstrap supervisor - the other in row security properties which could
allow to bypass policies and get read/write contrary to security policy.
[USN-6105-1] ca-certificates update (01:32)
CAs plus removes some that had either expired or that were now not used
anymore
[USN-6106-1] calamares-settings-ubuntu vulnerability (02:08)
password. Lubuntu uses it’s own installer called Calamares - so this issue
only affects Lubuntu, not regular Ubuntu or other Ubuntu flavors.
[USN-6100-1] HTML::StripScripts vulnerability (02:58)
[USN-6108-1] Jhead vulnerabilities (03:18)
jhead to rotate the file
[USN-6110-1] Jhead vulnerabilities
[USN-6113-1] Jhead vulnerability
[USN-6054-2] Django vulnerability (04:17)
[USN-6109-1, USN-6118-1] Linux kernel (Raspberry Pi + Oracle) vulnerabilities (04:29)
[USN-6122-1] Linux kernel (OEM) vulnerabilities (04:49)
can be triggered OOTB by an unpriv user on Ubuntu
anxious but since can be mitigated by disabling unprivileged user namespaces
perhaps it was not worth all the hype? Also kernel updates take a while to
prepare and test etc so it is not easy to just drop everything and crank a
new kernel - so in general this would only occur for remotely exploitable
issues
[USN-6123-1] Linux kernel (OEM) vulnerabilities (06:48)
VMs - could allow an guest VM to crash the VM host
[USN-6124-1] Linux kernel (OEM) vulnerabilities (07:10)
[USN-6097-1] Linux PTP vulnerability (07:20)
servers to sub-microsecond accuracy - more accurate than NTP - uses a
leader/follower architecture - leader would be synchronised with high accuracy
via say a GPS then distributes this to other machines via PTP
packets) - results in a OOB R/W - so could either be an info leak or possible
RCE
[USN-6005-2] Sudo vulnerabilities (08:49)
[USN-6111-1] Flask vulnerability (09:02)
mishandling of the Vary:Cookie header - requires the use of a caching proxy
and other conditions though so may not be a widespread issue
[USN-6112-1] Perl vulnerability (09:35)
download modules over HTTPS - failed to set ssl_Verify - parameter to
<:Tiny>
enable SSL verification by default as that would make applications etc that
use self-signed certs or community-driven CAs like CAcert.org fail - but this
seems pretty outdated since with Let’s Encrypt etc nowadays there is easy
access to trusted certs for anyone - and so this just does a disservice to all
applications that use <:Tiny> making them potentially insecure
out-of-the-box
this foot-gun
[USN-6114-1] nth-check vulnerability (11:32)
nth-child() and nth-last-of-type() functions) - can pass it a string and it
will compile that to an optimised function for calling by other code
[USN-6116-1] hawk vulnerability (12:11)
scheme that is similar to the regular HTTP Digest scheme - developed by Mozilla
[USN-6115-1] TeX Live vulnerability (12:47)
could access the io stream used by the underlying lua engine and inject
contents into it which would then be executed
[USN-6119-1] OpenSSL vulnerabilities (13:20)
have an object ID which itself is tens to hundreds of KBs - OpenSSL 3 has a
limit of 100KB on the peer cert chain which limits the ability to craft such
long IDs and have them be processed by OpenSSL
past the end of the input buffer -> OOB read -> possible DoS but only if the
ciphertext is a certain size relative to the block size
[USN-6120-1] SpiderMonkey vulnerabilities (14:25)
with CVEs in firefox etc.
updates
[USN-6121-1] Nanopb vulnerabilities (14:45)
on crafted messages - both only really an issue if parsing untrusted content
[USN-6117-1] Apache Batik vulnerabilities (15:16)
on the server
be executed
[USN-6125-1] snapd vulnerability (15:48)
the TIOCLINUX ioctl() request - could allow a snap to inject contents into the
controlling terminal when run on a virtual console - this would then be
executed when the snap finished running -> code exec outside the snap sandbox
CVE-2016-10124 in lxc, CVE-2017-5226 in bubblewrap, CVE-2019-10063 in flatpak
[USN-6126-1] libvirt vulnerabilities (17:44)
to race against the driver and corrupt the list of network filters and trigger
a crash in the libvirt daemon
Goings on in Ubuntu Security Community
Ubuntu 18.04 has now entered ESM (18:21)
OpenPrinting tutorial on handling security bugs via GitHub (19:40)
where all the development is usually done in the open, how do you privately
report and collaborate on a security issue?
maintainer to configure the templates etc that get sent out - also needs the
organisation that owns the repo to enable this as well
private fork in which to develop the fix
this
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
The venerable Ubuntu 18.04 LTS release has transitioned into ESM, plus we look
at Till Kamppeter’s excellent guide on how to set up your GitHub projects to
receive private vulnerability reports, and we cover the week in security updates
including PostgreSQL, Jhead, the Linux kernel, Linux PTP, snapd and a whole lot
more.
This week in Ubuntu Security Updates
56 unique CVEs addressed
[USN-6104-1] PostgreSQL vulnerabilities (00:55)
CREATE privileges - could then allow an auth user to execute arbitrary code as
a the bootstrap supervisor - the other in row security properties which could
allow to bypass policies and get read/write contrary to security policy.
[USN-6105-1] ca-certificates update (01:32)
CAs plus removes some that had either expired or that were now not used
anymore
[USN-6106-1] calamares-settings-ubuntu vulnerability (02:08)
password. Lubuntu uses it’s own installer called Calamares - so this issue
only affects Lubuntu, not regular Ubuntu or other Ubuntu flavors.
[USN-6100-1] HTML::StripScripts vulnerability (02:58)
[USN-6108-1] Jhead vulnerabilities (03:18)
jhead to rotate the file
[USN-6110-1] Jhead vulnerabilities
[USN-6113-1] Jhead vulnerability
[USN-6054-2] Django vulnerability (04:17)
[USN-6109-1, USN-6118-1] Linux kernel (Raspberry Pi + Oracle) vulnerabilities (04:29)
[USN-6122-1] Linux kernel (OEM) vulnerabilities (04:49)
can be triggered OOTB by an unpriv user on Ubuntu
anxious but since can be mitigated by disabling unprivileged user namespaces
perhaps it was not worth all the hype? Also kernel updates take a while to
prepare and test etc so it is not easy to just drop everything and crank a
new kernel - so in general this would only occur for remotely exploitable
issues
[USN-6123-1] Linux kernel (OEM) vulnerabilities (06:48)
VMs - could allow an guest VM to crash the VM host
[USN-6124-1] Linux kernel (OEM) vulnerabilities (07:10)
[USN-6097-1] Linux PTP vulnerability (07:20)
servers to sub-microsecond accuracy - more accurate than NTP - uses a
leader/follower architecture - leader would be synchronised with high accuracy
via say a GPS then distributes this to other machines via PTP
packets) - results in a OOB R/W - so could either be an info leak or possible
RCE
[USN-6005-2] Sudo vulnerabilities (08:49)
[USN-6111-1] Flask vulnerability (09:02)
mishandling of the Vary:Cookie header - requires the use of a caching proxy
and other conditions though so may not be a widespread issue
[USN-6112-1] Perl vulnerability (09:35)
download modules over HTTPS - failed to set ssl_Verify - parameter to
<:Tiny>
enable SSL verification by default as that would make applications etc that
use self-signed certs or community-driven CAs like CAcert.org fail - but this
seems pretty outdated since with Let’s Encrypt etc nowadays there is easy
access to trusted certs for anyone - and so this just does a disservice to all
applications that use <:Tiny> making them potentially insecure
out-of-the-box
this foot-gun
[USN-6114-1] nth-check vulnerability (11:32)
nth-child() and nth-last-of-type() functions) - can pass it a string and it
will compile that to an optimised function for calling by other code
[USN-6116-1] hawk vulnerability (12:11)
scheme that is similar to the regular HTTP Digest scheme - developed by Mozilla
[USN-6115-1] TeX Live vulnerability (12:47)
could access the io stream used by the underlying lua engine and inject
contents into it which would then be executed
[USN-6119-1] OpenSSL vulnerabilities (13:20)
have an object ID which itself is tens to hundreds of KBs - OpenSSL 3 has a
limit of 100KB on the peer cert chain which limits the ability to craft such
long IDs and have them be processed by OpenSSL
past the end of the input buffer -> OOB read -> possible DoS but only if the
ciphertext is a certain size relative to the block size
[USN-6120-1] SpiderMonkey vulnerabilities (14:25)
with CVEs in firefox etc.
updates
[USN-6121-1] Nanopb vulnerabilities (14:45)
on crafted messages - both only really an issue if parsing untrusted content
[USN-6117-1] Apache Batik vulnerabilities (15:16)
on the server
be executed
[USN-6125-1] snapd vulnerability (15:48)
the TIOCLINUX ioctl() request - could allow a snap to inject contents into the
controlling terminal when run on a virtual console - this would then be
executed when the snap finished running -> code exec outside the snap sandbox
CVE-2016-10124 in lxc, CVE-2017-5226 in bubblewrap, CVE-2019-10063 in flatpak
[USN-6126-1] libvirt vulnerabilities (17:44)
to race against the driver and corrupt the list of network filters and trigger
a crash in the libvirt daemon
Goings on in Ubuntu Security Community
Ubuntu 18.04 has now entered ESM (18:21)
OpenPrinting tutorial on handling security bugs via GitHub (19:40)
where all the development is usually done in the open, how do you privately
report and collaborate on a security issue?
maintainer to configure the templates etc that get sent out - also needs the
organisation that owns the repo to enable this as well
private fork in which to develop the fix
this
Get in contact