[Security] Mitigation & Patch

marav · 05-04-2023, 03:48 PM

shadow

CVE-2023-29383

Code:

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger).
Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list),
it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work
around blocking of the : character make it possible to give the impression that a new user has been added. In other words, 
an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered 
denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

https://www.cve.org/CVERecord?id=CVE-2023-29383

Patch:

Code:

Added control character check, returning -1 (to "err") if control characters are present

https://github.com/shadow-maint/shad...18411ebfac663d

volkerdi · 05-04-2023, 05:25 PM

Quote:

Originally Posted by marav

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger).

We don't use that version of chfn, but rather the one in util-linux.

marav · 05-04-2023, 07:19 PM

Quote:

Originally Posted by volkerdi

We don't use that version of chfn, but rather the one in util-linux.

I saw it too late

Code:

  # Don't ship the login utilities. We'll be using the ones from util-linux:
  for file in /bin/login /sbin/runuser /usr/bin/chfn /usr/bin/chsh \
    /usr/man/man1/chfn.1.gz /usr/man/man1/chsh.1.gz /usr/man/man1/login.1.gz \
    /usr/man/man1/runuser.1.gz ; do
    rm -f $PKG${file}
  done

GazL · 05-05-2023, 05:01 AM

The admin shouldn't be using 'cat' for viewing files anyway, especially so when they're security related such as /etc/passwd. Tricks with control characters and terminal escape sequences have been known of for decades.

marav · 05-05-2023, 04:40 PM

coreutils

Code:

cp: -p --parents: fix failure to preserve permissions for absolute paths

bug:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=63245

Patch:
https://git.savannah.gnu.org/cgit/co...c1d0d6e895fdf4

marav · 05-10-2023, 01:38 PM

kwin

Bug:

Code:

Maximized XWayland apps leave pixel gaps when using a fractional scaling factor

https://bugs.kde.org/show_bug.cgi?id=459373

Patch:
https://invent.kde.org/plasma/kwin/-...2237391e.patch

marav · 05-12-2023, 03:15 PM

kde-cli-tools

I noticed kinfo expecting kcmshell6, but kde-cli-tools provides kcmshell5

Code:

/usr/bin/kinfo: line 6: exec: kcmshell6: not found

So here is a patch:

Code:

--- a/kinfo/kinfo       2023-05-12 22:09:03.367999463 +0200
+++ b/kinfo/kinfo     2023-05-12 22:09:17.533922027 +0200
@@ -3,4 +3,4 @@
 # SPDX-FileCopyrightText: 2023 Harald Sitter <sitter@kde.org>
 
 export QT_LOGGING_RULES="*=false"
-exec kcmshell6 kcm_about-distro --args dump --platform offscreen
+exec kcmshell5 kcm_about-distro --args dump --platform offscreen

marav · 05-12-2023, 03:23 PM

Quote:

Originally Posted by marav

kde-cli-tools

I noticed kinfo expecting kcmshell6, but kde-cli-tools provides kcmshell5

Code:

/usr/bin/kinfo: line 6: exec: kcmshell6: not found

So here is a patch:

Code:

--- a/kinfo/kinfo       2023-05-12 22:09:03.367999463 +0200
+++ b/kinfo/kinfo     2023-05-12 22:09:17.533922027 +0200
@@ -3,4 +3,4 @@
 # SPDX-FileCopyrightText: 2023 Harald Sitter <sitter@kde.org>
 
 export QT_LOGGING_RULES="*=false"
-exec kcmshell6 kcm_about-distro --args dump --platform offscreen
+exec kcmshell5 kcm_about-distro --args dump --platform offscreen

Fixed here:
https://invent.kde.org/plasma/kde-cl...05dd00b98aa85a

cwizardone · 05-12-2023, 08:09 PM

Quote:

Intel Issues New CPU Microcode Going Back To Gen8 For New, Undisclosed Security Updates
By Michael Larabel. 12 May 2023.
Well, this is a bit strange... Intel just published Friday afternoon CPU microcode updates for all supported processor families back to Coffee Lake "Gen 8" for undisclosed security updates........

The full story can be found at, https://www.phoronix.com/news/Intel-...2023-Microcode

marav · 05-18-2023, 08:28 PM

cups-filter

CVE-2023-24805

Code:

cups-filters contains backends, filters, and other software required to get the cups printing service working on
operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network 
printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = 
system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple
user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can
exploit this vulnerability to inject system commands which are executed in the context of the running server. 
This issue has been addressed in commit `8f2740357` and is expected to be bundled in the next release. Users are
advised to upgrade when possible and to restrict access to network printers in the meantime.

https://www.cve.org/CVERecord?id=CVE-2023-24805

Report:
https://github.com/OpenPrinting/cups...gpxc-v2m8-fr3x

Patch:
https://github.com/OpenPrinting/cups...9d4c4447287d65

Didier Spaier · 05-23-2023, 04:13 AM

According to LuaTeX Security Vulnerabilities:

Quote:

2023-05-20
Summary

Any document compiled with older versions of LuaTeX can execute arbitrary shell commands, even with shell escape disabled.
This affects LuaTeX versions 1.04–1.16.1, which were included in TeX Live 2017–2022 as well as the original release of TeX Live 2023. This issue was fixed in LuaTeX 1.17.0, and is distributed as an update to TeX Live 2023.
This issue has been assigned CVE-2023-32700.

In Slackware 15.0:

Code:

luatex --version
This is LuaTeX, Version 1.13.2 (TeX Live 2021 on Slackware)

So I suggest to apply one of the patches from other distributions mentioned under Timeline at the bottom of the linked to document or build from the updated sources that it mentions. Thanks to Philippe Delavalade for the heads-up.

gbschenkel · 05-23-2023, 12:29 PM

Security Advisory: Qt Network

Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not matching directly. Unencrypted connections are susceptible to man-in-the-middle attacks. Those connections could be established by using URLs with the http instead of the https scheme. With HSTS, the https scheme must be used regardless.

Solution: Apply the following patch or update to Qt 5.15.14, Qt 6.2.9 or Qt 6.5.1

Patches:

dev: https://codereview.qt-project.org/c/qt/qtbase/+/477560
Qt 6.5: https://codereview.qt-project.org/c/qt/qtbase/+/476494 or https://download.qt.io/official_rele...tbase-6.5.diff
Qt 6.2: https://download.qt.io/official_rele...tbase-6.2.diff
Qt 5.15: https://download.qt.io/official_rele...base-5.15.diff

metaed · 05-23-2023, 05:29 PM

Curl security update 8.1.0 for Slackware 15.0 breaks all-numeric hostnames

After applying the recommended security update Curl 8.1.0 to Slackware-64 15.0, some well-formed URLs cannot be parsed.
The problem is an acknowledged regression in Curl 8.1.0.
An emergency patch release tagged Curl 8.1.1 was posted by the Curl team.

The above is a summary of:
https://www.linuxquestions.org/quest...es-4175725326/
now hopefully posted in the right place. Sorry for the noise!

opty · 05-25-2023, 10:33 AM

ntfs-3g 2022.10.3:

Code:

Security release 2022.10.3 (Oct 31, 2022)

    Rejected zero-sized runs
    Avoided merging runlists with no runs

Security version 2022.5.17 (May 26, 2022)

    Improved defence against maliciously tampered NTFS partitions
    Improved defence against improper use of options
    Updated the documentation

opty · 06-01-2023, 02:43 AM

ntp 4.2.8p16:

Code:

---
NTP 4.2.8p16 (Harlan Stenn <stenn@ntp.org>, 2023 May 30)

Focus: Security, Bug fixes

Severity: LOW

This release:

- fixes 4 vulnerabilities (3 LOW and 1 None severity), 
- fixes 46 bugs
- includes 15 general improvements
- adds support for OpenSSL-3.0

Details below:

* [Sec 3808] Assertion failure in ntpq on malformed RT-11 date <perlinger@ntp.org>
* [Sec 3807] praecis_parse() in the Palisade refclock driver has a
             hypothetical input buffer overflow. Reported by ... stenn@
* [Sec 3806] libntp/mstolfp.c needs bounds checking <perlinger@ntp.org>
  - solved numerically instead of using string manipulation
* [Sec 3767] An OOB KoD RATE value triggers an assertion when debug is enabled.
             <stenn@ntp.org>

Edit: Observing possible issues on #ntp at Libera.Chat so no rush.

Another edit:

Code:

13:10:37 <opty> i use "pool cz.pool.ntp.org iburst", do you recommend upgrade to 4.2.8p16 then?
[...]
13:13:54 <@harlan> opty: I could be wrong.  It seems to me like this change, even if we don't keep it, will only cause
                   potential difficulty at the initial start, and the long-term behavior seems clearly better.
13:14:02 <davehart> opty pool associations have their initial poll delayed by 3s after the response to solicitation.  They
                    are not affected by the up to 64s first poll issue in p16, so I would recommend you upgrade.  I'd also
                    recommend you consider trying the change to automatically hone in the best pool servers from your unique
                    perspective.  That's at https://people.nwtime.org/hart/ntp-dev-3792-msm-v2.tar.gz