Ubuntu Security Podcast

Episode 98

Listen Later
Overview

This week we look at updates for c-ares, PulseAudio, phpMyAdmin and more,

plus we cover security news from the Ubuntu community including planning
for 16.04 LTS to transition to ESM, libgcrypt FIPS cerified for 18.04 LTS
and a proposal for making home directories more secure for upcoming Ubuntu
releases as well.

This week in Ubuntu Security Updates

48 unique CVEs addressed

[USN-4638-1] c-ares vulnerability [01:00]
  • 1 CVEs addressed in Groovy (20.10)
    • CVE-2020-8277
    • C library for performing async DNS requests and name resolution - a fork
      • of the ares library with additional support for IPv6, and 64-bit/cross
      platform support
    • In particular is used by Node.js for DNS support - reported as a DoS via
      • a remote attacker who could cause a Node.js application to perform a DNS
      request to a chosen host where a large number of DNS records - internally
      is a buffer-over-read - c-ares would return data of length N but with a
      purported length of >N - only in more recent releases so only affected
      groovy
      [USN-4639-1] phpMyAdmin vulnerabilities [02:37]
      • 13 CVEs addressed in Bionic (18.04 LTS)
        • CVE-2020-26935
        • CVE-2020-26934
        • CVE-2020-10803
        • CVE-2020-10802
        • CVE-2019-6799
        • CVE-2020-5504
        • CVE-2020-10804
        • CVE-2019-6798
        • CVE-2019-12616
        • CVE-2019-11768
        • CVE-2018-7260
        • CVE-2018-19970
        • CVE-2018-19968
        • Various issues - multiple different instances of each of the following:
          • XSS, SQL injection, CSRF, sensitive info leaks etc
          [USN-4637-2] Firefox vulnerabilities [03:08]
          • 15 CVEs addressed in Xenial (16.04 LTS)
            • CVE-2020-26969
            • CVE-2020-26968
            • CVE-2020-26967
            • CVE-2020-26965
            • CVE-2020-26963
            • CVE-2020-26962
            • CVE-2020-26961
            • CVE-2020-26960
            • CVE-2020-26959
            • CVE-2020-26958
            • CVE-2020-26956
            • CVE-2020-26953
            • CVE-2020-26952
            • CVE-2020-26951
            • CVE-2020-16012
            • Episode 97
            • Xenial takes longer usually due to toolchain issues between old versions
              • in xenial vs newer things used in Firefox (ie rust etc)
              [USN-4634-2] OpenLDAP vulnerabilities [03:57]
              • 2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM)
                • CVE-2020-25710
                • CVE-2020-25709
                • Episode 97 - 2 DoS issues
                  • [USN-4640-1] PulseAudio vulnerability [04:13]
                  • 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
                    • CVE-2020-16123
                    • Discovered and resolved by James Henstridge from the Ubuntu Desktop Team
                    • Race condition in snap policy module could allow a confined snap to
                      • bypass snap pulseaudio restrictions - ie. could record audio when only
                      authorised to playback audio
                    • https://twitter.com/JamesHenstridge/status/1331161130740248580
                      • [USN-4641-1] libextractor vulnerabilities [06:20]
                      • 12 CVEs addressed in Xenial (16.04 LTS)
                        • CVE-2018-20431
                        • CVE-2018-14347
                        • CVE-2018-14346
                        • CVE-2017-17440
                        • CVE-2017-15922
                        • CVE-2017-15602
                        • CVE-2017-15601
                        • CVE-2018-20430
                        • CVE-2018-16430
                        • CVE-2017-15600
                        • CVE-2017-15267
                        • CVE-2017-15266
                        • Used to extract metadata from various file formats (HTML, PS, MS Office,
                          • audio, images, video, archives, packages etc)
                        • NULL ptr deref, divide by zero, OOB read, infinite loop, stack buffer
                          • overflows, heap buffer overflows etc
                          [USN-4642-1] PDFResurrect vulnerability [07:28]
                          • 1 CVEs addressed in Xenial (16.04 LTS)
                            • CVE-2020-9549
                            • Extract / manipulate revision info in PDFs
                            • OOB write
                              • [USN-4643-1] atftp vulnerabilities [07:56]
                              • 2 CVEs addressed in Xenial (16.04 LTS)
                                • CVE-2019-11366
                                • CVE-2019-11365
                                • TFTP server / client
                                • NULL ptr deref due to race condition from missing mutex lock - different
                                  • threads can race on the same data -> DoS
                                • stack buffer overflow due to unsafe calls to strncpy -> DoS / RCE
                                  • [USN-4644-1] igraph vulnerability [08:35]
                                  • 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
                                    • CVE-2018-20349
                                    • NULL ptr deref
                                      • Goings on in Ubuntu Security Community
                                      Ubuntu 16.04 LTS moving to ESM webinar [08:52]
                                      • https://www.brighttalk.com/webcast/6793/453617
                                      • 8th December 2020, 4pm UTC
                                        • Security Certifications - libgcrypt on Ubuntu 18.04 is FIPS 140-2 certified [10:13]
                                        • https://discourse.ubuntu.com/t/security-certifications-libgcrypt-on-ubuntu-18-04-is-fips-140-2-certified/19511
                                        • Ubuntu 18.04 LTS can now provide FIPS certified full disk encryption as via libgcrypt which is now FIPS certified
                                        • Certified for 5 years until 2025
                                          • Private home directories for Ubuntu 21.04 onwards? [10:45]
                                          • https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2020-November/018842.html
                                          • https://discourse.ubuntu.com/t/private-home-directories-for-ubuntu-21-04-onwards/19533
                                            • Get in contact
                                            • [email protected]
                                            • #ubuntu-security on the Libera.Chat IRC network
                                            • ubuntu-hardened mailing list
                                            • Security section on discourse.ubuntu.com
                                            • @ubuntu_sec on twitter
                                              • ...more
                                              View all episodesView all episodes
                                              Download on the App Store
                                              Ubuntu Security PodcastBy Ubuntu Security Team
                                              • 4.8
                                              • 4.8
                                              • 4.8
                                              • 4.8
                                              • 4.8

                                              4.8

                                              10 ratings