This is the audio podcast version of Troy Hunt's weekly update video published here: https://www.troyhunt.com/tag/weekly-update/
…
continue reading
Alex Murray and Ubuntu Security Team에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Alex Murray and Ubuntu Security Team 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
Player FM -팟 캐스트 앱
Player FM 앱으로 오프라인으로 전환하세요!
Player FM 앱으로 오프라인으로 전환하세요!
Episode 141
Manage episode 313862257 series 2423058
Alex Murray and Ubuntu Security Team에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Alex Murray and Ubuntu Security Team 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
Overview
A preview of some things to come for the Ubuntu Security Podcast plus we cover security updates for Samba, uriparser, libmodbus, MariaDB, Mailman and more.
This week in Ubuntu Security Updates
38 unique CVEs addressed
[USN-5174-1] Samba vulnerabilities [00:58]
- 4 CVEs addressed in Bionic (18.04 LTS)
- Few weeks ago published Samba updates for a range of vulns - mentioned in Episode 139 the difficulties involved in patching older Samba versions like 4.7.6 as used in Ubuntu 18.04 - backports of patches for the more severe vulnerabilities including the ability for authenticated attackers to escalate privileges to root on domain machines and others
[USN-5142-2] Samba regressions [02:06]
- 9 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Original upstream patches caused a bunch of regressions - once upstream subsequently fixed these, we then updated our backports to include those regression fixes
- How soon to ship vuln fixes?
[USN-5171-1] Long Range ZIP vulnerabilities [03:22]
- 9 CVEs addressed in Bionic (18.04 LTS)
- Compression tool optimised to achieve better performance on larger files
- Results of fuzzing by various researchers over time - AFL
- 4 UAFs, 2 stack buffer overflows, 2 infinite loop, 1 heap buffer overflow
[USN-5172-1] uriparser vulnerabilities [03:56]
- 4 CVEs addressed in Bionic (18.04 LTS)
- More fuzzing results -> Google AutoFuzz - seems to manage oss-fuzz etc
- OOB write, integer overflow, OOB read, NULL ptr deref
[USN-5173-1] libmodbus vulnerabilities [04:36]
- 2 CVEs addressed in Bionic (18.04 LTS)
- 1 vuln originally - OOB read on certain input - patch for this however contained a typo which then introduced a second vuln on a subset of the original input - second CVE assigned for that - both now fixed
[USN-5170-1] MariaDB vulnerability [05:13]
- 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Latest upstream point releases:
- 10.5.13 -> 21.04, 21.10
- 10.3.32 -> 20.04
- As usual not much details on the vuln (MariaDB fork of MySQL, maintained by Oracle who don’t provide a lot of specific details in their vulnerability reports)
[USN-5178-1] Django vulnerability [06:04]
- 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Failed to handle URLs with embedded trailing newlines - newline would cause the URL to not match the existing URL path-based access controls so could bypass those
[USN-5179-1] BusyBox vulnerabilities [06:33]
- 10 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Busybox implements a lot of standard unix utilities in a single binary
- UAF / OOB write when decompressing crafted gzip files
- Heap OOB on when decompressing crafted lzma
- Lots of UAFs in awk impl
[USN-5180-1] Mailman vulnerability [07:37]
- 1 CVEs addressed in Bionic (18.04 LTS)
- Wouldn’t validate that a CSRF token used for admin pages was actually issued for that context - so a regular list user could take their own CSRF token, craft a URL for the admin user with this token and if the admin user visited that then they could evade the inteded CSRF protections - so could say change the admindb password etc
[USN-5168-4] NSS regression [08:47]
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- Typo in backported patch could cause NSS to fail in some circumstances and cause an SSL session to fail (DoS)
Goings on in Ubuntu Security Community
Preview of some upcoming content and changes [09:26]
Get in contact
231 에피소드
Manage episode 313862257 series 2423058
Alex Murray and Ubuntu Security Team에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Alex Murray and Ubuntu Security Team 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
Overview
A preview of some things to come for the Ubuntu Security Podcast plus we cover security updates for Samba, uriparser, libmodbus, MariaDB, Mailman and more.
This week in Ubuntu Security Updates
38 unique CVEs addressed
[USN-5174-1] Samba vulnerabilities [00:58]
- 4 CVEs addressed in Bionic (18.04 LTS)
- Few weeks ago published Samba updates for a range of vulns - mentioned in Episode 139 the difficulties involved in patching older Samba versions like 4.7.6 as used in Ubuntu 18.04 - backports of patches for the more severe vulnerabilities including the ability for authenticated attackers to escalate privileges to root on domain machines and others
[USN-5142-2] Samba regressions [02:06]
- 9 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Original upstream patches caused a bunch of regressions - once upstream subsequently fixed these, we then updated our backports to include those regression fixes
- How soon to ship vuln fixes?
[USN-5171-1] Long Range ZIP vulnerabilities [03:22]
- 9 CVEs addressed in Bionic (18.04 LTS)
- Compression tool optimised to achieve better performance on larger files
- Results of fuzzing by various researchers over time - AFL
- 4 UAFs, 2 stack buffer overflows, 2 infinite loop, 1 heap buffer overflow
[USN-5172-1] uriparser vulnerabilities [03:56]
- 4 CVEs addressed in Bionic (18.04 LTS)
- More fuzzing results -> Google AutoFuzz - seems to manage oss-fuzz etc
- OOB write, integer overflow, OOB read, NULL ptr deref
[USN-5173-1] libmodbus vulnerabilities [04:36]
- 2 CVEs addressed in Bionic (18.04 LTS)
- 1 vuln originally - OOB read on certain input - patch for this however contained a typo which then introduced a second vuln on a subset of the original input - second CVE assigned for that - both now fixed
[USN-5170-1] MariaDB vulnerability [05:13]
- 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Latest upstream point releases:
- 10.5.13 -> 21.04, 21.10
- 10.3.32 -> 20.04
- As usual not much details on the vuln (MariaDB fork of MySQL, maintained by Oracle who don’t provide a lot of specific details in their vulnerability reports)
[USN-5178-1] Django vulnerability [06:04]
- 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Failed to handle URLs with embedded trailing newlines - newline would cause the URL to not match the existing URL path-based access controls so could bypass those
[USN-5179-1] BusyBox vulnerabilities [06:33]
- 10 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
- Busybox implements a lot of standard unix utilities in a single binary
- UAF / OOB write when decompressing crafted gzip files
- Heap OOB on when decompressing crafted lzma
- Lots of UAFs in awk impl
[USN-5180-1] Mailman vulnerability [07:37]
- 1 CVEs addressed in Bionic (18.04 LTS)
- Wouldn’t validate that a CSRF token used for admin pages was actually issued for that context - so a regular list user could take their own CSRF token, craft a URL for the admin user with this token and if the admin user visited that then they could evade the inteded CSRF protections - so could say change the admindb password etc
[USN-5168-4] NSS regression [08:47]
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- Typo in backported patch could cause NSS to fail in some circumstances and cause an SSL session to fail (DoS)
Goings on in Ubuntu Security Community
Preview of some upcoming content and changes [09:26]
Get in contact
231 에피소드
All episodes
×플레이어 FM에 오신것을 환영합니다!
플레이어 FM은 웹에서 고품질 팟캐스트를 검색하여 지금 바로 즐길 수 있도록 합니다. 최고의 팟캐스트 앱이며 Android, iPhone 및 웹에서도 작동합니다. 장치 간 구독 동기화를 위해 가입하세요.