Overview

images, plus we look at security updates for CUPS, Avahi, the Linux kernel, FRR,

Go and more.

This week in Ubuntu Security Updates

[USN-6128-1, USN-6128-2] CUPS vulnerability (00:56)

cupsd.conf to have LogLevel as debug which is not usually the case

[USN-6129-1] Avahi vulnerability (01:39)

dereference and crash - found via dfuzzer - a fuzzer for D-Bus services

[USN-6130-1] Linux kernel vulnerabilities (02:23)

requires an attacker to create a malicious USB device and insert that into

your machine to be able to trigger (shout out to USBGuard)

unprivileged user namespace (again)

[USN-6127-1] Linux kernel vulnerabilities (04:41)

[USN-6135-1] Linux kernel (Azure CVM) vulnerabilities (05:06)

[USN-6131-1] Linux kernel vulnerabilities (05:18)

[USN-6132-1] Linux kernel vulnerabilities (05:30)

[USN-6133-1] Linux kernel (Intel IoTG) vulnerabilities (05:42)

[USN-6134-1] Linux kernel (Intel IoTG) vulnerabilities

[USN-6112-2] Perl vulnerability (05:54)

[USN-6136-1] FRR vulnerabilities (06:19)

lengths when reading packet structures, implemented in C

[USN-6137-1] LibRaw vulnerabilities (06:43)

etc)

[USN-6138-1] libssh vulnerabilities (07:01)

the verification process there is insufficient memory - fails, leaves in error

state that then falls though to an OK state

[USN-6139-1] Python vulnerability (07:37)

incomplete

[USN-6140-1] Go vulnerabilities (07:57)

failing to properly parse various delimiting elements (like backtick ` for JS

etc)

[USN-6141-1] xfce4-settings vulnerability (08:31)

call xdg-open with crafted input that would then get passed through to

whatever application (like say the browser / file manager etc) and hence could

run these other applications with arbitrary arguments - e.g. could embed a

link in a PDF and when the user clicks this can then get say the browser to be

launched with arbitrary arguments

controlled domain which is then allowed to connect to the local debugging port

and hence execute arbitrary JS on any other domain - steal creds etc

[USN-6142-1] nghttp2 vulnerability (10:16)

setting a max limit for these frame types and rejecting if too large

[USN-6143-1] Firefox vulnerabilities (10:50)

[USN-6144-1] LibreOffice vulnerabilities (10:59)

[USN-6028-2] libxml2 vulnerabilities (11:35)

Goings on in Ubuntu Security Community

Recent report of invalid GPG signatures on 16.04 ISOs (12:04)

old-releases.ubuntu.com failed to validate

file) been tampered with?

file and then sign the file containing that list of hashes - for performance

and so does not validate properly

older thread where someone mentioned that they are able to upload arbitrary

keys to the ubuntu keyserver that mimic the archive / CD image signing keys

etc - this is the nature of key servers - anyone can upload any key with any

arbitrary identifiers - but since keys are generated from randomness, it is

theoretically impossible to generate a key with the same underlying

cryptographic fingerprint (even if it has the same name / email address

associated with it)

fingerprint - these are listed on the wiki

https://wiki.ubuntu.com/SecurityTeam/FAQ#GPG_Keys_used_by_Ubuntu

/usr/share/keyrings/ubuntu-archive-keyring.gpg file from the ubuntu-keyring

package

wget -q https://old-releases.ubuntu.com/releases/xenial/SHA256SUMS{,.gpg}

gpg --verify --no-default-keyring --keyring=/usr/share/keyrings/ubuntu-archive-keyring.gpg --verbose SHA256SUMS.gpg SHA256SUMS

gpg: Signature made Fri 01 Mar 2019 02:56:07 ACDT

gpg: using DSA key 46181433FBB75451

gpg: Can't check signature: No public key

gpg: Signature made Fri 01 Mar 2019 02:56:07 ACDT

gpg: using RSA key D94AA3F0EFE21092

gpg: using pgp trust model

gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key (2012) " [unknown]

gpg: binary signature, digest algorithm SHA512, key algorithm rsa4096

February 2019 - this corresponds with the 16.04.6 point release - yet the most

recent point release was 16.04.7 from 13th August 2020 for BootHole (Alex and

Joe take an in-depth and behind-the-scenes look at BootHole / GRUB from

Episode 84) - so it appears that perhaps the various signature files were

not regenerated when the 16.04.7 point release was made (yet the various SUMS

files were)

all is good as can be seen below

gpg: Signature made Fri 09 Jun 2023 00:38:30 ACST

gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092

gpg: using pgp trust model

gpg: Good signature from "Ubuntu CD Image Automatic Signing Key (2012) " [unknown]

gpg: WARNING: This key is not certified with a trusted signature!

gpg: There is no indication that the signature belongs to the owner.

Primary key fingerprint: 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092

gpg: binary signature, digest algorithm SHA512, key algorithm rsa4096

attention

Get in contact