5 ms·

Ubuntu - http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7547.html http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20...

by bits 11y ago

nisa 11y ago
Just out of interest: How is this classified medium by Ubuntu? If someone manages to bypass ASLR this is a remote exploit on every SSH server running glibc out there? Or did I misunderstood something? Out of the box SSH seems to use getaddrinfo: reverse mapping checking getaddrinfo for <host> [<ip>] failed - POSSIBLE BREAK-IN ATTEMPT!
- Racsoo 11y ago
  Refresh the page. It was just updated > Priority: High
- idnar 11y ago
  Fairly sure the default changed to not doing this, although I'm not sure as of what release.
ptrincr 11y ago
Cheers!
collinmanderson 11y ago
Ubuntu Trusty 14.04 user here. Am I correct that there's no patch out yet?
- ptrincr 11y ago
  Not that I can see
  - collinmanderson 11y ago
    Thanks.
    - ptrincr 11y ago
      Latest version I can see from here - https://launchpad.net/ubuntu/trusty/+source/eglibc https://launchpad.net/ubuntu/trusty/+source/eglibc Is - https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.6 https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.6 apt-get update apt-cache show libc6 *snip* Version: 2.19-0ubuntu6.6 This was released on 2015-02-25
      - ptrincr 11y ago
        Patch out - https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7 https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7
- chinathrow 11y ago
  It takes time - too much in my opinion in this case.
- collinmanderson 11y ago
  Update: It looks like the patch is finally out.
  - atom_enger 11y ago
    What are you doing to pull this patch? I've apt-get updated and still am seeing Version: 2.19-0ubuntu6.6
    - ptrincr 11y ago
      Does appear to be out - https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7 https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7 apt-get update not seeing it at the moment though, guess its the mirror I'm using. Edit - working now. I can see: Version: 2.19-0ubuntu6.7
      - atom_enger 11y ago
        Yep I'm seeing it too. Thanks! Ubuntu just released this: http://www.ubuntu.com/usn/usn-2900-1/ http://www.ubuntu.com/usn/usn-2900-1/
  - deleted 11y ago
    [deleted]
orblivion 11y ago
Does "DNE" mean there's no patch coming at all, or none yet? What about pending? Also, why is all this important and useful information scattered all over the place? Ubuntu people, if you're reading, on this page: http://packages.ubuntu.com/trusty/libc6 http://packages.ubuntu.com/trusty/libc6 I think you should have a history of updates to the package, and which security vulnerabilities it covers, with a link back to the above linked page. Looking at this page, looking at my system, looking at the news, I kind of have no idea what's going on. I was going to complain that this people.canonical.com CVE page should also be linked from some sort of Ubuntu security bulletin, but I googled first and found that that's exactly where it's linked from. Still, I somehow reckon I would have never thought of that if not for this conversation. It should perhaps be linked from the packages page, though I'm not a UX guy, maybe that would just add confusion. But, this CVE page, with the domain "people.canonical.com", linking to launchpad pages, it doesn't look like it's made for users. You could make some improvements to make it more user friendly like the packages page. You could make it explicit: "Here's the packages you need to upgrade. here's the command to run to upgrade your whole system. Here's the command to upgrade just this package." As it stands, this doesn't even tell you what binary packages to get (libc6, I think? I'm still not even sure!), this just lists the source package (glibc). And, change "DNE" and "pending" to indicators that are more clear to us. Or, make a new page if this one is not meant for users. For security stuff (not just Ubuntu by any means), all sorts of useful information is scattered all over the place. To name a few questions that I never determined clear answers to: * What about this Android MMS attack that was supposed to be catastrophic and so easy to mount, that supposedly like half of all Android users are still vulnerable to? We've not heard of a single actual exploit in the wild. Where's some sort of official source downgrading its severity? * If the libpng thing was such a fiasco, why were there no updates in Ubuntu for so long? Did it turn out not to be such a serious attack vector? Where's the documentation on that determination? * For heartbleed: I recall having to poke around looking at the "built on" date for my openssl packages to see whether I was upgraded or not. That's not an acceptable state of affairs. I'm not looking for answers to these particular questions now, I'm just wondering, why do we all have to rely on rumors and advice from random people in discussion forums for this stuff? There's a recent trend of understanding that improved UX can improve security (Signal, etc). Here's a good place to make some improvements, IMHO. Sorry if I've come off as entitled here, it's just a source of irritation to me.

Ubuntu - http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7547.html http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20...

by bits 11y ago

Ubuntu - http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7547.html http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20...

nisa 11y ago

Just out of interest: How is this classified medium by Ubuntu? If someone manages to bypass ASLR this is a remote exploit on every SSH server running glibc out there? Or did I misunderstood something? Out of the box SSH seems to use getaddrinfo: reverse mapping checking getaddrinfo for <host> [<ip>] failed - POSSIBLE BREAK-IN ATTEMPT!

Racsoo 11y ago
Refresh the page. It was just updated > Priority: High
idnar 11y ago
Fairly sure the default changed to not doing this, although I'm not sure as of what release.

ptrincr 11y ago

Cheers!

collinmanderson 11y ago

Ubuntu Trusty 14.04 user here. Am I correct that there's no patch out yet?

ptrincr 11y ago
Not that I can see
- collinmanderson 11y ago
  Thanks.
  - ptrincr 11y ago
    Latest version I can see from here - https://launchpad.net/ubuntu/trusty/+source/eglibc https://launchpad.net/ubuntu/trusty/+source/eglibc Is - https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.6 https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.6 apt-get update apt-cache show libc6 *snip* Version: 2.19-0ubuntu6.6 This was released on 2015-02-25
    - ptrincr 11y ago
      Patch out - https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7 https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7
chinathrow 11y ago
It takes time - too much in my opinion in this case.
collinmanderson 11y ago
Update: It looks like the patch is finally out.
- atom_enger 11y ago
  What are you doing to pull this patch? I've apt-get updated and still am seeing Version: 2.19-0ubuntu6.6
  - ptrincr 11y ago
    Does appear to be out - https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7 https://launchpad.net/ubuntu/+source/eglibc/2.19-0ubuntu6.7 apt-get update not seeing it at the moment though, guess its the mirror I'm using. Edit - working now. I can see: Version: 2.19-0ubuntu6.7
    - atom_enger 11y ago
      Yep I'm seeing it too. Thanks! Ubuntu just released this: http://www.ubuntu.com/usn/usn-2900-1/ http://www.ubuntu.com/usn/usn-2900-1/
- deleted 11y ago
  [deleted]

orblivion 11y ago

Does "DNE" mean there's no patch coming at all, or none yet? What about pending? Also, why is all this important and useful information scattered all over the place? Ubuntu people, if you're reading, on this page: http://packages.ubuntu.com/trusty/libc6 http://packages.ubuntu.com/trusty/libc6 I think you should have a history of updates to the package, and which security vulnerabilities it covers, with a link back to the above linked page. Looking at this page, looking at my system, looking at the news, I kind of have no idea what's going on. I was going to complain that this people.canonical.com CVE page should also be linked from some sort of Ubuntu security bulletin, but I googled first and found that that's exactly where it's linked from. Still, I somehow reckon I would have never thought of that if not for this conversation. It should perhaps be linked from the packages page, though I'm not a UX guy, maybe that would just add confusion. But, this CVE page, with the domain "people.canonical.com", linking to launchpad pages, it doesn't look like it's made for users. You could make some improvements to make it more user friendly like the packages page. You could make it explicit: "Here's the packages you need to upgrade. here's the command to run to upgrade your whole system. Here's the command to upgrade just this package." As it stands, this doesn't even tell you what binary packages to get (libc6, I think? I'm still not even sure!), this just lists the source package (glibc). And, change "DNE" and "pending" to indicators that are more clear to us. Or, make a new page if this one is not meant for users. For security stuff (not just Ubuntu by any means), all sorts of useful information is scattered all over the place. To name a few questions that I never determined clear answers to: * What about this Android MMS attack that was supposed to be catastrophic and so easy to mount, that supposedly like half of all Android users are still vulnerable to? We've not heard of a single actual exploit in the wild. Where's some sort of official source downgrading its severity? * If the libpng thing was such a fiasco, why were there no updates in Ubuntu for so long? Did it turn out not to be such a serious attack vector? Where's the documentation on that determination? * For heartbleed: I recall having to poke around looking at the "built on" date for my openssl packages to see whether I was upgraded or not. That's not an acceptable state of affairs. I'm not looking for answers to these particular questions now, I'm just wondering, why do we all have to rely on rumors and advice from random people in discussion forums for this stuff? There's a recent trend of understanding that improved UX can improve security (Signal, etc). Here's a good place to make some improvements, IMHO. Sorry if I've come off as entitled here, it's just a source of irritation to me.