PLAY PODCASTS
Episode 186

Episode 186

The Ubuntu Security Podcast is back for 2023! We ease into the year with coverage of the recently announced launch of Ubuntu Pro as GA, plus we look at some recent vulns in git, sudo, OpenSSL and more.

Ubuntu Security Podcast · Ubuntu Security Team

February 10, 202315m 30s

Audio is streamed directly from the publisher (people.canonical.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.

Original episode page

Show Notes

Overview

The Ubuntu Security Podcast is back for 2023! We ease into the year with coverage of the recently announced launch of Ubuntu Pro as GA, plus we look at some recent vulns in git, sudo, OpenSSL and more.

This week in Ubuntu Security Updates

212 unique CVEs addressed

[USN-5778-1] X.Org X Server vulnerabilities

[USN-5779-1] Linux kernel (Azure) vulnerabilities

[USN-5780-1] Linux kernel (OEM) vulnerabilities

[USN-5781-1] Emacs vulnerability

[USN-5782-1] Firefox vulnerabilities

[USN-5783-1] Linux kernel (OEM) vulnerability

[USN-5784-1] usbredir vulnerability

  • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)

[USN-5785-1] FreeRADIUS vulnerabilities

[USN-5786-1] GNOME Files vulnerability

  • 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5787-1] Libksba vulnerability

  • 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5782-2] Firefox regressions

[USN-5789-1] Linux kernel (OEM) vulnerabilities

[USN-5788-1] curl vulnerabilities

[USN-5790-1] Linux kernel vulnerabilities

[USN-5791-1] Linux kernel vulnerabilities

[USN-5792-1] Linux kernel vulnerabilities

[USN-5793-1] Linux kernel vulnerabilities

[USN-5794-1] Linux kernel (AWS) vulnerabilities

[USN-5787-2] Libksba vulnerability

  • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)

[USN-5795-1] Net-SNMP vulnerabilities

[USN-5796-1] w3m vulnerability

  • 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5797-1] WebKitGTK vulnerabilities

[USN-5792-2] Linux kernel vulnerabilities

[USN-5793-2] Linux kernel (Azure) vulnerabilities

[USN-5782-3] Firefox regressions

[USN-5796-2] w3m vulnerability

[USN-5798-1] .NET 6 vulnerability

  • 1 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10)

[USN-5791-3] Linux kernel (Azure) vulnerabilities

[USN-5793-3] Linux kernel vulnerabilities

[USN-5793-4] Linux kernel (IBM) vulnerabilities

[USN-5799-1] Linux kernel (OEM) vulnerability

[USN-5800-1] Heimdal vulnerabilities

[USN-5802-1] Linux kernel vulnerabilities

[USN-5803-1] Linux kernel vulnerabilities

[USN-5804-1] Linux kernel vulnerabilities

[USN-5801-1] Vim vulnerabilities

[USN-5804-2] Linux kernel vulnerabilities

[USN-5805-1] Apache Maven vulnerability

[USN-5795-2] Net-SNMP vulnerabilities

[USN-5808-1] Linux kernel (IBM) vulnerabilities

[USN-5810-1, USN-5810-2, USN-5810-3] Git vulnerabilities [01:16]

  • 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • Integer overflow when parsing really long paths specified in .gitattributes
    • But depends if file is in working tree, index or both since when parsed normally the parsing is done in chunks which mitigates the vuln
    • leads to heap reads/writes -> RCE
  • Integer overflow when using a crafted format specifier for git log or git archive
    • Not too common to use random format specifiers, but how many people have wanted a prettier git log output, and copy-pasted something from stack overflow without understanding it?
    • We talk about the provenance and integrity of code for OSS / supply chain attacks - interesting to think about it from a configuration / data point of view
      • Can ChatGPT be poisoned to spit out dangerous configs?

[USN-5811-1, USN-5811-2, USN-5811-3] Sudo vulnerabilities [03:34]

  • 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
  • Most interesting was a vuln in sudoedit - ie the command to edit a file with sudo - launches your specified editor to edit the file
  • The editor is specified via various environment variables - SUDO_EDITOR, VISUAL or EDITOR - these would normally specify the binary of the editor to use
  • But could also include extra arguments to pass to the editor - such as additional filenames by separating them with a double hyphen --
  • As such a user could set their EDITOR=vim -- /etc/shadow - then when sudoedit launches the editor for the originally specified file, would also launch it with this file too
  • Allows a user to bypass possible restrictions set via /etc/sudoers - ie since could be configured to only allow a user to edit say the apache config via sudoedit

[USN-5812-1] urllib3 vulnerability

[USN-5810-2] Git regression

[USN-5813-1] Linux kernel vulnerabilities

[USN-5814-1] Linux kernel vulnerabilities

[USN-5815-1] Linux kernel (BlueField) vulnerabilities

[USN-5816-1] Firefox vulnerabilities

[USN-5817-1] Setuptools vulnerability

  • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5818-1] PHP vulnerability

  • 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5819-1] HAProxy vulnerability

  • 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5806-2] Ruby vulnerability

  • 1 CVEs addressed in Bionic (18.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5820-1] exuberant-ctags vulnerability

  • 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5821-1] wheel vulnerability

  • 1 CVEs addressed in Trusty ESM (14.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5822-1] Samba vulnerabilities

[USN-5823-1] MySQL vulnerabilities

[USN-5823-2] MySQL vulnerability

[USN-5825-1] PAM vulnerability

  • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)

[USN-5826-1] Privoxy vulnerabilities

← All episodes of Ubuntu Security Podcast