Ubuntu Security Podcast

Episode 41

Listen Later
Overview

With Alex and Joe having been away at a Canonical sprint last week, we look back at the past fortnight’s security updates including new Linux kernel releases, MySQL, VLC, Django and more plus we discuss a recent Citrix password spraying attack.

This week in Ubuntu Security Updates

90 unique CVEs addressed

[USN-4066-2] ClamAV vulnerability
  • 1 CVEs addressed in Precise ESM, Trusty ESM
    • CVE-2019-1010305
    • Episode 40 - libmspack buffer overflow - ClamAV contains own copy of
      • libmspack in older releases so is affected
      [USN-4065-2] Squid vulnerabilities
      • 2 CVEs addressed in Precise ESM
        • CVE-2019-12529
        • CVE-2019-12525

          • Episode 40 (memory corruption issues)

          [USN-4067-1] Evince vulnerability
          • 1 CVEs addressed in Xenial
            • CVE-2019-1010006
            • Integer overflow -> buffer overflow when handling embedded tiff content in PDF documents
            • DoS -> possible RCE
              • [USN-4068-1, USN-4068-2] Linux kernel vulnerabilities
              • 4 CVEs addressed in Bionic and Xenial (HWE)
                • CVE-2019-11884
                • CVE-2019-11833
                • CVE-2019-11815
                • CVE-2019-11085
                • 2 information disclosure vulnerabilities:
                  • Exposes kernel memory to user-space which could expose sensitive
                    • information (keys, pointers to help defeat ASLR etc)
                  • Bluetooth Human Interface Device Protocol (HIDP) socket ioctl() failed
                    • to NUL terminate the name field
                  • Ext4 file-system did not zero out unused regions in extents tree blocks
                    • which are returned to user-space
                  • Use-after-free due to a race-condition in the reliable datagram socket
                    • (RDS) protocol module -> crash / code exec
                    • Blacklisted by default in Ubuntu and contrary to the original CVE
                      • description, this is not likely to be remotely exploitable since the
                      use-after-free only occurs on namespace cleanup
                    • Intel i915 graphics driver failed to validate ranges for mmap() in some places
                      • Local attacker who already has access to the device could use this to
                        • crash / code execution -> privilege escalation
                        [USN-4076-1] Linux kernel vulnerabilities
                        • 6 CVEs addressed in Xenial
                          • CVE-2019-10142
                          • CVE-2019-9503
                          • CVE-2019-2054
                          • CVE-2019-11884
                          • CVE-2019-11833
                          • CVE-2018-20836
                          • Freescale Hypervisor Manager (HVM) for PowerPC - used invalid size
                            • parameter from ioctl() for page size calculations - local attacker could
                            use this to cause various memory corruption issues possibly resulting in
                            privilege escalation or code execution (only enabled in Xenial 4.4
                            kernel)
                          • Broadcom wifi driver would possibly pass through firmware events received
                            • on-the-air to the local USB wifi device - allows a remote attacker to
                            send firmware events to the device having unspecified impact
                          • Possible seccomp bypass for policies that use ptrace on ARM - a tracing
                            • process could modify a syscall parameter after the seccomp decision for
                            that syscall had been made - so could violate the policy
                          • Bluetooth HIDP + Ext4 extents information disclosure vulns covered earlier
                          • Race condition in Serial Attached SCSI (SAS) could possibly result in a
                            • UAF -> crash, or code execution
                            [LSN-0053-1] Linux kernel vulnerability
                            • 5 CVEs addressed in Xenial, Bionic
                              • CVE-2019-11884
                              • CVE-2019-11833
                              • CVE-2019-11815
                              • CVE-2019-2054
                              • CVE-2011-1079
                              • RDS UAF, Bluetooth HIDP + Ext4 extents information disclosure vulns covered earlier
                              • Seccomp bypass on ARM
                              • Separate bluetooth info disclosure via ioctl() for a similar non-NUL
                                • terminated string
                                [USN-4069-1, USN-4069-2] Linux kernel vulnerabilities
                                • 4 CVEs addressed in Disco and Bionic (HWE)
                                  • CVE-2019-11884
                                  • CVE-2019-11833
                                  • CVE-2019-11599
                                  • CVE-2019-11487
                                  • 2 information disclosure issues mentioned for the Bionic/Xenial HWE above
                                    • (4.15 kernel) - Bluetooth HIDP + Ext4 extents information disclosure
                                    vulns covered earlier
                                  • Race condition in coredump generation - local user can trigger coredump
                                    • for a process which can race with other memory managment handling and so
                                    could result in access to invalid memory regions - crash -> DoS or
                                    information disclosure
                                  • Integer overflow for page reference counts -> UAF
                                    • Requires at least 140GB of RAM to be affected
                                      • [USN-4070-1] MySQL vulnerabilities
                                      • 13 CVEs addressed in Xenial, Bionic, Disco
                                        • CVE-2019-2819
                                        • CVE-2019-2805
                                        • CVE-2019-2797
                                        • CVE-2019-2791
                                        • CVE-2019-2778
                                        • CVE-2019-2774
                                        • CVE-2019-2758
                                        • CVE-2019-2757
                                        • CVE-2019-2741
                                        • CVE-2019-2740
                                        • CVE-2019-2739
                                        • CVE-2019-2738
                                        • CVE-2019-2737
                                        • Latest upstream version 5.7.27 - various vulnerabilities including:
                                          • Multiple variants of low privileged remote attacker could gain complete
                                            • access to all MySQL server data (modify / access etc)
                                          • Multiple versions of privileged AND unprivileged attacker could hang /
                                            • crash MySQL server
                                            [USN-4071-1, USN-4071-2] Patch vulnerabilities
                                            • 2 CVEs addressed in Trusty ESM, Xenial, Bionic, Disco
                                              • CVE-2019-13638
                                              • CVE-2019-13636
                                              • OS shell command injection via a crafted patch file - uses shell meta
                                                • characters to take control of patch
                                              • Mishandles symlinks which allows a crafted patch file to overwrite
                                                • arbitrary files
                                                [USN-4072-1] Ansible vulnerabilities
                                                • 8 CVEs addressed in Xenial, Bionic, Disco
                                                  • CVE-2019-3828
                                                  • CVE-2018-10875
                                                  • CVE-2018-10874
                                                  • CVE-2019-10156
                                                  • CVE-2018-16876
                                                  • CVE-2018-16837
                                                  • CVE-2018-10855
                                                  • CVE-2017-7481
                                                  • Path traversal vulnerability in fetch module - allows an attacker to
                                                    • overwrite files outside of the specified destination
                                                  • Configuration or inventory variables read from CWD - local attacker could
                                                    • point to an arbitrary module / plugin under their control and so gain
                                                    code-execution as the ansible daemon
                                                  • Various issues with variable substitution which could result in any
                                                    • variable being substituted and thus an information disclosure
                                                    [USN-4073-1] libEBML vulnerability
                                                    • 1 CVEs addressed in Xenial, Bionic
                                                      • CVE-2019-13615
                                                      • VLC related issue - lots of media attention - “uninstall VLC now” etc - overblown
                                                      • Heap-based buffer over-read in the Matroska decoder - crash -> DoS - not
                                                        • code-execution
                                                      • However, VLC itself had a number of outstanding vulnerabilities
                                                        • [USN-4074-1] VLC vulnerabilities
                                                        • 4 CVEs addressed in Bionic, Disco
                                                          • CVE-2019-5439
                                                          • CVE-2019-13602
                                                          • CVE-2019-12874
                                                          • CVE-2018-19857
                                                          • 2 different heap-based buffer overflow - possible RCE but likely mitigated with ASLR (according to upstream)
                                                          • Double free -> crash -> DoS (glibc heap-protector ensures can’t cause heap corruption -> abort)
                                                          • Invalid pointer dereference (uninitialized) -> crash or infoleak
                                                            • [USN-4075-1] Exim vulnerability
                                                            • 1 CVEs addressed in Xenial, Bionic, Disco
                                                              • CVE-2019-13917
                                                              • Possible RCE as root if configuration used the ${sort } expansion on
                                                                • items that can be controlled by an attacker - ie. $domain etc
                                                                [USN-4054-2] Firefox regressions
                                                                • 21 CVEs addressed in Xenial, Bionic, Disco
                                                                  • CVE-2019-11730
                                                                  • CVE-2019-11729
                                                                  • CVE-2019-11728
                                                                  • CVE-2019-11727
                                                                  • CVE-2019-11725
                                                                  • CVE-2019-11724
                                                                  • CVE-2019-11723
                                                                  • CVE-2019-11721
                                                                  • CVE-2019-11720
                                                                  • CVE-2019-11719
                                                                  • CVE-2019-11718
                                                                  • CVE-2019-11717
                                                                  • CVE-2019-11716
                                                                  • CVE-2019-11715
                                                                  • CVE-2019-11714
                                                                  • CVE-2019-11713
                                                                  • CVE-2019-11712
                                                                  • CVE-2019-11711
                                                                  • CVE-2019-11710
                                                                  • CVE-2019-11709
                                                                  • CVE-2019-9811
                                                                  • Episode 40 - Firefox update for 68.0 contained some minor regressions
                                                                  • Upstream released 68.0.1 to fix these
                                                                    • [USN-3990-2] urllib3 vulnerability
                                                                    • 1 CVEs addressed in Trusty ESM
                                                                      • CVE-2019-11236
                                                                      • Episode 33 covered for standard support releases
                                                                        • [USN-4077-1] tmpreaper vulnerability
                                                                        • 1 CVEs addressed in Xenial, Bionic
                                                                          • CVE-2019-3461
                                                                          • Race condition when performing a bind-mount via rename() - local
                                                                            • privilege escalation since can result in a file being placed elsewhere on
                                                                            the fs hierarchy - so could drop a file in etc/cron.d for example to
                                                                            get root code execution
                                                                            [USN-4078-1] OpenLDAP vulnerabilities
                                                                            • 2 CVEs addressed in Xenial, Bionic, Disco
                                                                              • CVE-2019-13565
                                                                              • CVE-2019-13057
                                                                              • Would confuse authorisation for one user with another - so other user
                                                                                • could then perform operations which they were not entitled to - in SASL
                                                                                authentication code paths
                                                                                [USN-4079-1, USN-4079-2] SoX vulnerabilities
                                                                                • 4 CVEs addressed in Xenial, Bionic and Disco
                                                                                  • CVE-2019-8357
                                                                                  • CVE-2019-8356
                                                                                  • CVE-2019-8355
                                                                                  • CVE-2019-8354
                                                                                  • CLI audio converter etc - usual sorts of issues for a C based application handling complex input file formats:
                                                                                    • NULL ptr dereference
                                                                                    • Stack-based buffer overflow
                                                                                    • 2 separate integer overflows -> heap overflow
                                                                                      • [USN-4080-1] OpenJDK 8 vulnerabilities
                                                                                      • 7 CVEs addressed in Xenial
                                                                                        • CVE-2019-7317
                                                                                        • CVE-2019-2842
                                                                                        • CVE-2019-2816
                                                                                        • CVE-2019-2786
                                                                                        • CVE-2019-2769
                                                                                        • CVE-2019-2762
                                                                                        • CVE-2019-2745
                                                                                        • New upstream Java release 8u2222-b10
                                                                                          • [USN-4083-1] OpenJDK 11 vulnerabilities
                                                                                          • 7 CVEs addressed in Bionic, Disco
                                                                                            • CVE-2019-7317
                                                                                            • CVE-2019-2821
                                                                                            • CVE-2019-2818
                                                                                            • CVE-2019-2816
                                                                                            • CVE-2019-2786
                                                                                            • CVE-2019-2769
                                                                                            • CVE-2019-2762
                                                                                            • New upstream Java release 11.0.4
                                                                                              • [USN-4081-1] Pango vulnerability
                                                                                              • 1 CVEs addressed in Disco
                                                                                                • CVE-2019-1010238
                                                                                                • Heap-based buffer overflow -> code execution for applications which pass
                                                                                                  • invalid utf8 to Pango APIs like pango_itemize()
                                                                                                  [USN-4082-1] Subversion vulnerabilities
                                                                                                  • 2 CVEs addressed in Xenial
                                                                                                    • CVE-2019-0203
                                                                                                    • CVE-2018-11782
                                                                                                    • 2 remote DoS issues against svnserve
                                                                                                      • [USN-4084-1] Django vulnerabilities
                                                                                                      • 4 CVEs addressed in Xenial, Bionic, Disco
                                                                                                        • CVE-2019-14235
                                                                                                        • CVE-2019-14234
                                                                                                        • CVE-2019-14233
                                                                                                        • CVE-2019-14232
                                                                                                        • DoS via memory exhaustion when encoding an attacker controlled URI
                                                                                                        • SQL injection in key and index lookups in JSON handling
                                                                                                        • 2 different CPU based DoS - 1 in strip_tags() function if input contained
                                                                                                          • large sequence of nested, incomplete HTML entities, other in truncating
                                                                                                          due to use of regex with backtracking
                                                                                                          [USN-4085-1] Sigil vulnerability
                                                                                                          • 1 CVEs addressed in Xenial, Bionic, Disco
                                                                                                            • CVE-2019-14452
                                                                                                            • Zip slip vulnerability discovered by Mike Salvatore (Episode 40)
                                                                                                              • Goings on in Ubuntu Security Community
                                                                                                              Alex and Joe discuss the recent Citrix password spraying attack
                                                                                                              • https://threatpost.com/citrix-confirms-password-spraying-heist/146641/
                                                                                                                • Get in contact
                                                                                                                • [email protected]
                                                                                                                • #ubuntu-security on the Libera.Chat IRC network
                                                                                                                • @ubuntu_sec on twitter
                                                                                                                  • ...more
                                                                                                                  View all episodesView all episodes
                                                                                                                  Download on the App Store
                                                                                                                  Ubuntu Security PodcastBy Ubuntu Security Team
                                                                                                                  • 4.8
                                                                                                                  • 4.8
                                                                                                                  • 4.8
                                                                                                                  • 4.8
                                                                                                                  • 4.8

                                                                                                                  4.8

                                                                                                                  10 ratings