Episode 100

Overview

For the last episode of 2020, we look back at the most “popular” packages on this podcast for this year as well as the biggest vulnerabilities from 2020, plus a BootHole presentation at Ubuntu Masters as well as vulnerability fixes from the past week too.

This week in Ubuntu Security Updates

21 unique CVEs addressed

[USN-4660-1] Linux kernel vulnerabilities [01:04]

• 10 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS)
  • CVE-2020-4788
  • CVE-2020-28915
  • CVE-2020-25645
  • CVE-2020-25643
  • CVE-2020-25641
  • CVE-2020-25285
  • CVE-2020-25284
  • CVE-2020-25211
  • CVE-2020-14390
  • CVE-2020-14351
• Episode 99

[USN-4661-1] Snapcraft vulnerability [01:36]

• 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
  • CVE-2020-27348
• itszn reported via Launchpad - LD_LIBRARY_PATH as generated by snapcraft would contain an empty element - so cwd would be included - if an attacker can drop a malicious library that will be loaded by a snap (eg. libc.so) into your home dir (and since home plug is used by almost all snaps - and is autoconnected on non-Ubuntu Core systems) would allow the attacker to get code-execution in the context of any snap
• Fixed in snapcraft - as part of the snap USN notification service - notified all affected snap publishers just need to rebuild their snaps and users will get protected via snap refresh

[USN-4656-2] X.Org X Server vulnerabilities [04:20]

• 2 CVEs addressed in Trusty ESM (14.04 ESM)
  • CVE-2020-25712
  • CVE-2020-14360
• Episode 99

[USN-4662-1] OpenSSL vulnerability [04:34]

• 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-1971
• NULL pointer dereference when comparing two GENERAL_NAMEs with an EDIPARTYNAME - so if an attacker can cause this they can cause a crash -> DoS in any application which uses openssl for TLS handling etc - this can be done if an attacker can get a client to check a malicious cert against a malicious CRL - and since some apps auto-download CRLs based on URLs presented in the cert itself this is not an unreasonable scenario - hence high priority as the attack complexity is not high in this case

[USN-4663-1] GDK-PixBuf vulnerability [05:53]

• 1 CVEs addressed in Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-29385
• infinite loop when handling crafted LZW compression code in gifs -> DoS

[USN-4664-1] Aptdaemon vulnerabilities [06:31]

• 2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-27349
  • CVE-2020-16128
• Kevin Backhouse from Github reported via Launchpad
• aptdaemon provides dbus API for installing packages - provides an InstallFile method to install a local .deb - and uses policykit to ensure that unprivileged users cannot use this to install packages - however, that check only occurs after the deb has been parsed - so if there were vulns in the parsing (which is provided by apt itself) - since aptd runs as root could use these to get RCE - fixed by moving auth checks to occur before parsing anything

[USN-4665-1] curl vulnerabilities [08:32]

• 4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-8286
  • CVE-2020-8285
  • CVE-2020-8284
  • CVE-2020-8231
• Various issues:
  • memory leak in handling of FTP wildcard matchings -> DoS
  • failure to properly validate OCSP responses
  • incorrect handling of CONNECT_ONLY option -> could end up connecting to wrong host -> info leak
  • incorrect handling of FTP PASV responses - server can respond with alternate IP address + port to connect to -> could then trick clients into doing port-scanning on their behalf or other info gathering etc

Goings on in Ubuntu Security Community

Look back over 2020 of the Ubuntu Security Podcast

Top 20 most featured packages [10:09]

• 81 Linux kernel
• 16 Firefox
• 7 PHP
• 6 Thunderbird
• 6 Samba
• 6 NSS
• 6 Django
• 5 WebKitGTK+
• 5 Tomcat
• 5 Squid
• 5 QEMU
• 5 OpenLDAP
• 5 MySQL
• 5 ClamAV
• 4 X.Org X Server
• 4 SQLite
• 4 Python
• 4 ppp
• 4 OpenSSL
• 4 OpenJDK

Most high profile vulnerabilities [12:53]

• PLATYPUS attack against Intel CPUs (Episode 96)
• BleedingTooth attack against bluez (Episode 93)
• FreeType being exploited in the wild (Episode 93)
• BootHole attack against GRUB2 (Episode 84)

Ubuntu Masters 4 - Together We Sink or Swim: Plugging the BootHole [14:12]

• https://www.brighttalk.com/webcast/6793/453235
• Chris Coulson + Daniel Kiper (Oracle, upstream grub maintainer) + Jesse Michael (Eclypsium, discovered original BootHole vuln)
• Earlier today / yesterday

Hiring [15:58]

AppArmor Security Engineer

• https://canonical.com/careers/2114847

Engineering Director - Ubuntu Security

• https://canonical.com/careers/2439068

Engineering Manager - Ubuntu Security

• https://canonical.com/careers/2439058

Get in contact

• [email protected]
• #ubuntu-security on the Libera.Chat IRC network
• ubuntu-hardened mailing list
• Security section on discourse.ubuntu.com
• @ubuntu_sec on twitter