Sign up to save your podcasts
Or
Share Episode 46
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 46
Overview
A massive 85 CVEs addressed this week, including updates for Exim, the
Linux Kernel, Samba, systemd and more, plus we discuss hacking BMCs via
remote USB devices and password stashes.
This week in Ubuntu Security Updates
85 unique CVEs addressed
[USN-4124-1] Exim vulnerability [00:49]
headers - would try and handle escape sequences in this string.
what escape sequence is (\b etc) and then returns that actual value
(in string_interpret_escape())
translate escaped characters into their proper form in a new string -
and this will run over the bounds of the original string if it ends
with a backslash - since string_interpret_escape() would assume there
was contents afterwards to interpret
into a remote root exploit (since this part of the code runs as root
and they were able to use a combination of heap corruption and OOB
writes to get code execution)
handle the escaped character
a trailing backslash in the SNI field - see CVE-2019-15846 in the Ubuntu CVE Tracker
[USN-4114-1] Linux kernel vulnerabilities [03:49]
frame - exception and system crash (requires transactional memory to
be disabled)
IP packets) for connection-less protocols to avoid tracking
the hashing key used to generate the ID values
source host and hence can track devices
a better hashing algorithm (siphash) for ID generation
[USN-4115-1] Linux kernel vulnerabilities [06:42]
module unload after proc initialization failure etc), 12 medium
(allows to read kernel memory - KASLR defeat?)
structure in memory as hash base, could allow attacker to infer this
address and so defeat KASLR
since is not initializated) - Ubuntu defaults to a non-zero
mmap_min_addr value which means can’t map a page at 0 address so this
is just a NULL pointer dereference in default config (otherwise is
arbitrary kernel code execution)
communicate directly with one-another on the same network without
going via AP) - flaw allows a peer to cause wifi disconnection (DoS)
[USN-4116-1] Linux kernel vulnerabilities [09:12]
[USN-4117-1] Linux kernel (AWS) vulnerabilities [09:43]
[USN-4118-1] Linux kernel (AWS) vulnerabilities [10:17]
[USN-3934-2] PolicyKit vulnerability [10:36]
parts - 1 kernel to ensure can’t race kernel on PID assignment, and
second was in PolicyKit itself to check on PID, UID and start time.
[USN-4119-1] Irssi vulnerability [11:23]
capabilities - ie sasl support etc)
[USN-4121-1] Samba vulnerability [11:52]
attackers to gain access to the host filesystem outside the share
root (limited as per underlying file-system permissions)
using ‘unix extensions’ OR to have also set ‘allow insecure wide
links’
[USN-4120-1] systemd vulnerability [12:40]
server socket, whic allows unprivileged users to execute DBus methods
that should only be executable by privileged users - such as changing
the systems DNS resolver settings
[USN-4122-1] Firefox vulnerabilities [13:10]
[USN-4123-1] npm/fstream vulnerability [13:29]
Goings on in Ubuntu Security Community
Joe and Alex discuss hacking BMCs via a remote USN attack [13:53]
Joe and Alex also discuss password stashes [20:33]
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
A massive 85 CVEs addressed this week, including updates for Exim, the
Linux Kernel, Samba, systemd and more, plus we discuss hacking BMCs via
remote USB devices and password stashes.
This week in Ubuntu Security Updates
85 unique CVEs addressed
[USN-4124-1] Exim vulnerability [00:49]
headers - would try and handle escape sequences in this string.
what escape sequence is (\b etc) and then returns that actual value
(in string_interpret_escape())
translate escaped characters into their proper form in a new string -
and this will run over the bounds of the original string if it ends
with a backslash - since string_interpret_escape() would assume there
was contents afterwards to interpret
into a remote root exploit (since this part of the code runs as root
and they were able to use a combination of heap corruption and OOB
writes to get code execution)
handle the escaped character
a trailing backslash in the SNI field - see CVE-2019-15846 in the Ubuntu CVE Tracker
[USN-4114-1] Linux kernel vulnerabilities [03:49]
frame - exception and system crash (requires transactional memory to
be disabled)
IP packets) for connection-less protocols to avoid tracking
the hashing key used to generate the ID values
source host and hence can track devices
a better hashing algorithm (siphash) for ID generation
[USN-4115-1] Linux kernel vulnerabilities [06:42]
module unload after proc initialization failure etc), 12 medium
(allows to read kernel memory - KASLR defeat?)
structure in memory as hash base, could allow attacker to infer this
address and so defeat KASLR
since is not initializated) - Ubuntu defaults to a non-zero
mmap_min_addr value which means can’t map a page at 0 address so this
is just a NULL pointer dereference in default config (otherwise is
arbitrary kernel code execution)
communicate directly with one-another on the same network without
going via AP) - flaw allows a peer to cause wifi disconnection (DoS)
[USN-4116-1] Linux kernel vulnerabilities [09:12]
[USN-4117-1] Linux kernel (AWS) vulnerabilities [09:43]
[USN-4118-1] Linux kernel (AWS) vulnerabilities [10:17]
[USN-3934-2] PolicyKit vulnerability [10:36]
parts - 1 kernel to ensure can’t race kernel on PID assignment, and
second was in PolicyKit itself to check on PID, UID and start time.
[USN-4119-1] Irssi vulnerability [11:23]
capabilities - ie sasl support etc)
[USN-4121-1] Samba vulnerability [11:52]
attackers to gain access to the host filesystem outside the share
root (limited as per underlying file-system permissions)
using ‘unix extensions’ OR to have also set ‘allow insecure wide
links’
[USN-4120-1] systemd vulnerability [12:40]
server socket, whic allows unprivileged users to execute DBus methods
that should only be executable by privileged users - such as changing
the systems DNS resolver settings
[USN-4122-1] Firefox vulnerabilities [13:10]
[USN-4123-1] npm/fstream vulnerability [13:29]
Goings on in Ubuntu Security Community
Joe and Alex discuss hacking BMCs via a remote USN attack [13:53]
Joe and Alex also discuss password stashes [20:33]
Get in contact