Episode 141

Posted on Friday, Dec 10, 2021
A preview of some things to come for the Ubuntu Security Podcast plus we cover security updates for Samba, uriparser, libmodbus, MariaDB, Mailman and more.

Show Notes

Overview

A preview of some things to come for the Ubuntu Security Podcast plus we cover security updates for Samba, uriparser, libmodbus, MariaDB, Mailman and more.

This week in Ubuntu Security Updates

38 unique CVEs addressed

[USN-5174-1] Samba vulnerabilities [00:58]

  • 4 CVEs addressed in Bionic (18.04 LTS)
  • Few weeks ago published Samba updates for a range of vulns - mentioned in Episode 139 the difficulties involved in patching older Samba versions like 4.7.6 as used in Ubuntu 18.04 - backports of patches for the more severe vulnerabilities including the ability for authenticated attackers to escalate privileges to root on domain machines and others

[USN-5142-2] Samba regressions [02:06]

[USN-5171-1] Long Range ZIP vulnerabilities [03:22]

[USN-5172-1] uriparser vulnerabilities [03:56]

[USN-5173-1] libmodbus vulnerabilities [04:36]

  • 2 CVEs addressed in Bionic (18.04 LTS)
  • 1 vuln originally - OOB read on certain input - patch for this however contained a typo which then introduced a second vuln on a subset of the original input - second CVE assigned for that - both now fixed

[USN-5170-1] MariaDB vulnerability [05:13]

  • 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
  • Latest upstream point releases:
    • 10.5.13 -> 21.04, 21.10
    • 10.3.32 -> 20.04
  • As usual not much details on the vuln (MariaDB fork of MySQL, maintained by Oracle who don’t provide a lot of specific details in their vulnerability reports)

[USN-5178-1] Django vulnerability [06:04]

  • 1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
  • Failed to handle URLs with embedded trailing newlines - newline would cause the URL to not match the existing URL path-based access controls so could bypass those

[USN-5179-1] BusyBox vulnerabilities [06:33]

[USN-5180-1] Mailman vulnerability [07:37]

  • 1 CVEs addressed in Bionic (18.04 LTS)
  • Wouldn’t validate that a CSRF token used for admin pages was actually issued for that context - so a regular list user could take their own CSRF token, craft a URL for the admin user with this token and if the admin user visited that then they could evade the inteded CSRF protections - so could say change the admindb password etc

[USN-5168-4] NSS regression [08:47]

  • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
  • Typo in backported patch could cause NSS to fail in some circumstances and cause an SSL session to fail (DoS)

Goings on in Ubuntu Security Community

Preview of some upcoming content and changes [09:26]

Get in contact