Sign up to save your podcasts
Or
Share Episode 231
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 231
Overview
A look into CISA’s Known Exploited Vulnerability Catalogue is on our minds this
week, plus we look at vulnerability updates for gdb, Ansible, CUPS, libheif,
Roundcube, the Linux kernel and more.
This week in Ubuntu Security Updates
175 unique CVEs addressed
[USN-6842-1] gdb vulnerabilities (01:10)
parsing of crafted ELF executables -> NULL ptr deref or possible heap based
buffer overflow -> DoS/RCE
and crafted debug info files as well -> DoS/RCE
[USN-6845-1] Hibernate vulnerability (02:12)
literals when they are used in the SQL comments of a query when logging is
enabled - fixed by properly escaping comments in this case
[USN-6846-1] Ansible vulnerabilities (02:46)
since failed to validate the tower_callback (nowadays is called aap_callback -
Ansible Automation Platform) parameter appropriately
untrusted source - won’t get evaluated/expanded when used to avoid possible
info leaks etc - various issues where ansible would fail to respect this and
essentially forget they were tagged as unsafe and end up exposing secrets as a
result
[USN-6844-1] CUPS vulnerability (04:08)
parameter to make it world-writable - if this was a symlink, would then make
the target of the symlink world-readable - in general the cups config file is
only writable by root so requires some other vuln to be able to exploit it
where you can get write access to the config file to exploit it OR be able to
replace the regular cups socket path with a user-controlled symlink - but if
you can, then you can even change the cups config itself to be world-writable
and hence modify other parameters like the user and group that cups should run
as, as well as a crafted FoomaticRIPCommandLine then can run arbitrary commands
as root
[USN-6849-1] Salt vulnerabilities (06:20)
access to other methods, allowing them to be used without authentication -
could then either allow arbitrary directory access or the ability to retrieve
tokens from the master or run arbitrary commands on minions
[USN-6746-2] Google Guest Agent and Google OS Config Agent vulnerability (06:44)
in an infinite loop -> DoS
[USN-6850-1] OpenVPN vulnerability (07:04)
when using multiple authentication plugins and deferred authentication
[USN-6847-1] libheif vulnerabilities (07:36)
Format - part of the MPEG-H standard - container format used to store images
or sequences of images
[USN-6848-1] Roundcube vulnerabilities (08:21)
an SVG could embed JS that then gets loaded when the email is viewed
a crafted Content-Type/Content-Disposition header which can be used for
attachment preview/download
[USN-6819-4] Linux kernel (Oracle) vulnerabilities (09:21)
in-kernel TLS implementation
crypto engine can’t process them all in time - can then end up having
the async callback invoked twice
which handles the socket could close this before all the operations had
been scheduled
both able to be triggered via an unpriv userns
Goings on in Ubuntu Security Community
Discussion of CISA KEV
prevalence of memory unsafe languages in various critical open source
projects
the Bifrost and Valhall drivers - in Ubuntu we only ship the related
Midgard driver back in bionic and focal so not affected by this one
Library, Bash, Roundcube (mentioned earlier but not this particular vuln),
WinRAR (unrar), not to mention a number against the Linux kernel
various other systems like perf, AF_PACKET, tty, ptrace, futex and
others
patching process
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
A look into CISA’s Known Exploited Vulnerability Catalogue is on our minds this
week, plus we look at vulnerability updates for gdb, Ansible, CUPS, libheif,
Roundcube, the Linux kernel and more.
This week in Ubuntu Security Updates
175 unique CVEs addressed
[USN-6842-1] gdb vulnerabilities (01:10)
parsing of crafted ELF executables -> NULL ptr deref or possible heap based
buffer overflow -> DoS/RCE
and crafted debug info files as well -> DoS/RCE
[USN-6845-1] Hibernate vulnerability (02:12)
literals when they are used in the SQL comments of a query when logging is
enabled - fixed by properly escaping comments in this case
[USN-6846-1] Ansible vulnerabilities (02:46)
since failed to validate the tower_callback (nowadays is called aap_callback -
Ansible Automation Platform) parameter appropriately
untrusted source - won’t get evaluated/expanded when used to avoid possible
info leaks etc - various issues where ansible would fail to respect this and
essentially forget they were tagged as unsafe and end up exposing secrets as a
result
[USN-6844-1] CUPS vulnerability (04:08)
parameter to make it world-writable - if this was a symlink, would then make
the target of the symlink world-readable - in general the cups config file is
only writable by root so requires some other vuln to be able to exploit it
where you can get write access to the config file to exploit it OR be able to
replace the regular cups socket path with a user-controlled symlink - but if
you can, then you can even change the cups config itself to be world-writable
and hence modify other parameters like the user and group that cups should run
as, as well as a crafted FoomaticRIPCommandLine then can run arbitrary commands
as root
[USN-6849-1] Salt vulnerabilities (06:20)
access to other methods, allowing them to be used without authentication -
could then either allow arbitrary directory access or the ability to retrieve
tokens from the master or run arbitrary commands on minions
[USN-6746-2] Google Guest Agent and Google OS Config Agent vulnerability (06:44)
in an infinite loop -> DoS
[USN-6850-1] OpenVPN vulnerability (07:04)
when using multiple authentication plugins and deferred authentication
[USN-6847-1] libheif vulnerabilities (07:36)
Format - part of the MPEG-H standard - container format used to store images
or sequences of images
[USN-6848-1] Roundcube vulnerabilities (08:21)
an SVG could embed JS that then gets loaded when the email is viewed
a crafted Content-Type/Content-Disposition header which can be used for
attachment preview/download
[USN-6819-4] Linux kernel (Oracle) vulnerabilities (09:21)
in-kernel TLS implementation
crypto engine can’t process them all in time - can then end up having
the async callback invoked twice
which handles the socket could close this before all the operations had
been scheduled
both able to be triggered via an unpriv userns
Goings on in Ubuntu Security Community
Discussion of CISA KEV
prevalence of memory unsafe languages in various critical open source
projects
the Bifrost and Valhall drivers - in Ubuntu we only ship the related
Midgard driver back in bionic and focal so not affected by this one
Library, Bash, Roundcube (mentioned earlier but not this particular vuln),
WinRAR (unrar), not to mention a number against the Linux kernel
various other systems like perf, AF_PACKET, tty, ptrace, futex and
others
patching process
Get in contact