Episode 29

Overview

This week we look at fixes from the past two weeks including BIND, NTFS-3G, Dovecot, Pacemaker and more, plus we follow up last episodes IoT security discussion with Joe McManus talking about Ubuntu Core. Finally we cover the release of Ubuntu 19.04 Disco Dingo and the transition of Ubuntu 14.04 Trusty Tahr to Extended Security Maintenance.

These past two weeks in Ubuntu Security Updates

53 unique CVEs addressed

[USN-3947-1, USN-3947-2] Libxslt vulnerability

• 1 CVEs addressed in Precise ESM, Trusty, Xenial, Bionic, Cosmic
  • CVE-2019-11068
• Library to transform XML via XML definitions
• Includes a security framework since XSLT can define operations to fetch/read/write files and resources etc
• Various functions would return 0 if an operation is not allowed by the framework which was checked for and correctly disallowed - BUT they could also return -1 on error (say from a potentially bad URL) which would not be caught and so then would proceed and would fetch from the URL in question thereby violating the security policy
• Fixed to also check for error codes on handle the same as an explicit policy violation

[USN-3948-1] WebKitGTK+ vulnerabilities

• 14 CVEs addressed in Bionic, Cosmic
  • CVE-2019-8563
  • CVE-2019-8559
  • CVE-2019-8558
  • CVE-2019-8551
  • CVE-2019-8544
  • CVE-2019-8536
  • CVE-2019-8535
  • CVE-2019-8524
  • CVE-2019-8523
  • CVE-2019-8518
  • CVE-2019-8506
  • CVE-2019-8375
  • CVE-2019-6251
  • CVE-2019-11070
• Wide mix of issues fixed including XSS and DoS attacks or possible arbitrary code execution if visiting a malicious website

[USN-3949-1] OpenJDK 11 vulnerability

• 1 CVEs addressed in Bionic
  • CVE-2019-2422
• Backport of openjdk-11 from Disco to Bionic, includes a minor security fix to memory disclosure vulnerablity which could enable an attacker to bypass sandbox

[USN-3918-4] Firefox regressions

• 17 CVEs addressed in Trusty, Xenial, Bionic, Cosmic
  • CVE-2019-9803
  • CVE-2019-9793
  • CVE-2019-9809
  • CVE-2019-9808
  • CVE-2019-9807
  • CVE-2019-9806
  • CVE-2019-9805
  • CVE-2019-9802
  • CVE-2019-9799
  • CVE-2019-9797
  • CVE-2019-9796
  • CVE-2019-9795
  • CVE-2019-9792
  • CVE-2019-9791
  • CVE-2019-9790
  • CVE-2019-9789
  • CVE-2019-9788
• Episode 26 covered 66.0.2 regression - this is now 66.0.3 to fix further regressions in keyboard handling as discussed previously

[USN-3914-2] NTFS-3G update

• Affecting Xenial, Bionic, Cosmic
• Episode 25 covered ntfs-3g update for possible heap buffer overflow
  • As was setuid root this could possibly be used for root privilege escalation
• This update removes setuid root to additionally harden ntfs-3g so that any future vulnerablilites can’t be used for privilege escalation

[USN-3950-1] ZNC vulnerability

• 1 CVEs addressed in Cosmic
  • CVE-2019-9917
• crash -> DoS due to improper handling of character encoding - if a remote user specified an invalid encoding it could cause znc to crash
• Fixed to fallback to utf-8 if unknown encoding specified

[USN-3951-1] Dovecot vulnerability

• 1 CVEs addressed in Cosmic, Disco
  • CVE-2019-10691
• Only affects Dovecot 2.3 and hence only Cosmic, Disco, Eoan etc
• Improper handling of invalid utf-8 username in JSON encoding could cause the authentication service to crash

[USN-3952-1] Pacemaker vulnerabilities

• 3 CVEs addressed in Xenial, Bionic, Cosmic, Disco
  • CVE-2019-3885
  • CVE-2018-16878
  • CVE-2018-16877
• Cluster resource manager - high availability and load balancing for OpenStack
• All discovered by Jan Pokorný - local attacker could possibly escalate privileges or cause a denial of service or to cause sensitive information to be leaked to system logs

[USN-3953-1] PHP vulnerabilities

• 2 CVEs addressed in Xenial, Bionic, Cosmic, Disco
  • CVE-2019-11035
  • CVE-2019-11034
• php7.2 and php7.0
• Buffer over-read when processing certain EXIF tags - possible information disclosure or crash -> DoS

[USN-3922-2, USN-3922-3] PHP vulnerabilities

• 7 CVEs addressed in Precise ESM, Trusty
  • CVE-2019-9641
  • CVE-2019-9640
  • CVE-2019-9639
  • CVE-2019-9638
  • CVE-2019-9637
  • CVE-2019-9675
  • CVE-2019-9022
• Most covered back in Episode 26

[USN-3936-2] AdvanceCOMP vulnerability

• 1 CVEs addressed in Disco
  • CVE-2019-9210
• Corresponding update for Disco - covered in Episode 27

[USN-3954-1] FreeRADIUS vulnerabilities

• 2 CVEs addressed in Bionic, Cosmic, Disco
  • CVE-2019-11235
  • CVE-2019-11234
• 2 possible “Dragonblood” authentication bypass issues - mentioned back in Episode 28 in the context of wpa_supplicant and hostapd - similar issue for FreeRADIUS

[USN-3955-1] tcpflow vulnerabilities

• 2 CVEs addressed in Xenial, Bionic, Cosmic
  • CVE-2018-18409
  • CVE-2018-14938
• Stack based buffer overflow and an integer overflow -> usual effects (crash -> DoS / information disclosure)

[USN-3956-1] Bind vulnerability

• 1 CVEs addressed in Xenial, Bionic, Cosmic, Disco
  • CVE-2018-5743
• DoS - possible to bypass bind’s limits on simultaneous TCP clients and so cause a DoS via excessive resource usage

IoT Security follow-up with Joe McManus

• Alex and Joe follow up on last episode’s conversation about IoT and in particular talk about Ubuntu Core and how this has been engineered to address many of these common IoT security design and implementation flaws

Goings on in Ubuntu Security Community

Ubuntu 19.04 Disco Dingo Released

• Released on Thursday 18th April
• Officially supported by Canonical for 9 months - with security fixes for packages in main by the security team

Ubuntu 14.04 Trusty Tahr transitions to Extended Security Maintenance

• Standard support period concluded on Thursday 25th April
• Users are encouraged to upgrade to our latest LTS release 18.04 via 16.04
• Extended security maintenance is now available via Ubuntu Advantage
• https://blog.ubuntu.com/2019/02/05/ubuntu-14-04-trusty-tahr
• https://www.ubuntu.com/esm

Hiring

Ubuntu Security Generalist

• https://boards.greenhouse.io/canonical/jobs/1548812

Robotics Security Engineer

• https://boards.greenhouse.io/canonical/jobs/1550997

Get in contact

• [email protected]
• #ubuntu-security on the Libera.Chat IRC network
• @ubuntu_sec on twitter