6 ms·

Ubuntu LTS: many vulnerabilities despite long-term support

128 points by therealmarv 11y ago

rhinoceraptor 11y ago
To be fair, many packaged applications in popular distros are insecure (OwnCloud in Debian as one example). The developers of the applications will tell users specifically not to install the packaged version of the application, because it is out of date and/or insecure. PPAs were supposed to solve this problem, and the official line is that Snap packages are supposed to solve this problem, but better.
- fulafel 11y ago
  I don't remember ever seeing a ppa systematically handle security updates. It stands for "personal package archive" and lives up to its name... A rare few vendor ppas are frequently updated with the newest major version of the app for latest 1 or 2 LTS releases until they aren't, that's about the best I've seen.
- ashitlerferad 11y ago
  owncloud was removed from Debian.
  - deleted 11y ago
    [deleted]
- therealmarv 11y ago
  snap is also not the silver bullet https://mjg59.dreamwidth.org/42320.html https://mjg59.dreamwidth.org/42320.html
  - slgeorge 11y ago
    Snap packages with isolation aren't a 'silver bullet' but they are a step forward. It continues a trajectory of trying to secure desktop endusers with steps like AppArmor and kernel hardening that were don't for other LTS releases. At least in terms of package format, the difficulty with dpkg is that a) general software developers don't understand it, and b) it's not transactional in the sense you can't reverse what's happened easily. Trying to get commercial developers onto Linux is very difficult: on the desktop side they often don't see the point of such a small platform, and on the server side they feel it's super complicated and difficult. It might be stating the obvious but most developers aren't system administrators, so they really, really struggle with packaging and complain about dpkg/rpm a lot. Appstores are both tools and a process: Ubuntu did developer.ubuntu.com to provide an easy process for developers, and snap packages are another step along that way. Lets not let the perfect get in the way of the improved!
DyslexicAtheist 11y ago
"The thing is that those vulnerabilities are all fixed in Debian as all provided packages are maintained and security fixes are backported." Why can't Canonical move these fixes to Ubuntu LTS then? Seems the majority of the work (finding the cause, patching the code) was already done and corrections are sitting on some development branches from other distros.
- rhinoceraptor 11y ago
  Too busy working on a mobile platform that no one will ever use?
- rlpb 11y ago
  Ubuntu accepts contributed security updates for all packages, including for those in universe. Canonical only pro-actively monitors and pushes security updates for packages in main. Packages in universe gets security updates if and when they are contributed by the community. The "majority of the work" is done by upstream really, not other distros. The remaining work is backporting and QA which is distribution-specific, since the target versions (both of the package being updated and interactions with other packages that might be affected) are not necessarily the same.
- kijin 11y ago
  That's the problem with frozen releases. Upstream just moves ahead with new versions, but the distro insists on keeping the same version and only backporting a few patches. This might make sense for core packages that need to present a stable API throughout the lifecycle of an LTS release, but it creates a whole bunch of needless work for maintainers of other packages (who are often the same people who work upstream). Frozen distros are essentially telling them to create a frankenversion of their own program, one for each distro, based on some arbitrary version from several months or even years ago. Until a few years ago, most distros shipped a frozen version of Firefox and only backported important fixes. Ubuntu finally gave up and started shipping new versions of Firefox as soon as Mozilla releases them. I think they need to do the same with most of the packages in "universe", too, including the vast majority of GUI apps. No backporting, just pull the new version, build it, and run some tests. It would save a lot of duplicate work that every upstream is already doing, at negligible cost to the stability of the LTS release as a whole.
ausjke 11y ago
A bit scary but I understand ubuntu probably don't have the resource to watch all those packages all the time for verifying/backporting/testing etc. As far as security goes, Ubuntu really should work together with Debian to leverage each other to better the situation. My sites run either LTS or Debian and now I'm more worried.
- lamarkia 11y ago
  Not so much actual worry. Such panic articles appear regularly. If you stick with official packages, you are fine. It is the front-facing services that are important, and these are updated for security issues.
  - ausjke 11y ago
    I ran those checks and most problematic packages are related to ruby, as I ran redmine which uses Ruby.
fulafel 11y ago
As there's already automatic(?) tracking for unfixed CVEs in "universe" at https://people.canonical.com/~ubuntu-security/cve/universe.html https://people.canonical.com/~ubuntu-security/cve/universe.h..., it would be a short step to a local tool that disables and/or warns users about running the programs when there are remote vulnerabilities. All in all it's pretty irresponsible to allow the current situation in the first place. Don't ship vulnerability-prone internet-facing C apps that you can't patch. I wonder what the patch situation in practice is with CentOS installs that enable EPEL?
- embik 11y ago
  > All in all it's pretty irresponsible to allow the current situation in the first place. Don't ship vulnerability-prone internet-facing C apps that you can't patch. I think it's even worse because they won't patch or remove it. They could, but they do not consider it a problem. Ubuntu just imports everything from Debian. Things not relevant to the core team at Canonical are just thrown at the community basically saying "if you want a safe OS, you have to support this by yourself now". All the while Canonical is building their in-house, partly closed-source solutions to already solved problems.
  - slgeorge 11y ago
    That description of how Ubuntu deals with repositories is factually wrong. There are two repositories (in essense), Main and Universe [0]. For packages in Main a core developer (could be Canonical or someone else) has to be assigned to look after it and the Ubuntu security team has to allow it into the repository on the basis of it having a good security record and being maintainable [1]: it is _true_ that the Ubuntu security team is basically all Canonical employees. Many of these packages follow the upstream and don't come from Debian: or in some cases it's the same Canonical employee who maintains both the Debian and the Ubuntu packages so they might upload to Debian and pull in, or upload to both [2]. For Universe, Ubuntu pulls and builds from Debian. Many packages are sponsored by a maintainer who can then choose to upload their own package rather than use the latest sync from Debian. They aren't "thrown" to the community, rather they are never "promoted" to Main. All distributions have to choose how they deal with the large 'Universe' of software out there: in the Debian/Ubuntu world there's always been a lot of packages, compared to commercial RPM world. In Ubuntu's case the decision was to build/provide those packages, and let users decide what they wanted to do: for a 100% secured environment you would only turn on Main which is why the tools show you the supported status. The next question is whether it's a problem. It's not a problem if you understand a bit about how your distribution works. We can also look at the fact that it's been this way since Ubuntu started - so from 2004 it's worked like this. Clearly you don't like Ubuntu, which is fair enough: but I have to ask what you mean by "partly closed-source solutions" when there's nothing involving desktop Ubuntu that is closed-source. I assume you don't like Unity or something, but it's very much open source. Unless you are thinking of something else I'm unaware of? [0] https://help.ubuntu.com/community/Repositories/Ubuntu https://help.ubuntu.com/community/Repositories/Ubuntu [1] https://wiki.ubuntu.com/MainInclusionProcess https://wiki.ubuntu.com/MainInclusionProcess [2] https://www.piware.de/tag/debian/ https://www.piware.de/tag/debian/ is an example of someone who does this.
m4r71n 11y ago
I don't quite understand why people are upset with this. This is common in every, single Linux distro. Some vulnerabilities are simply not worth patching. Debian also has quite a few unpatched issues: https://security-tracker.debian.org/tracker/status/unreported https://security-tracker.debian.org/tracker/status/unreporte... And CentOS doesn't even publish that data because it would probably terrify you... The fact is that not all vulnerabilities are equal. Some silly crashing bug in Wireshark cannot be equated to an easily-exploitable RCE in some widely used library. I am pretty sure most of the latter are fixed everywhere, whereas the former should be ignored. If your use case really really requires fixing such low importance issues, then patch it yourself, or pay support fees to someone who will do it for you. And the fact that Debian patches some issues but Ubuntu does not is simply a question of how much work has been put into it. If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora. Ubuntu, I assume, must go through a much more grueling process to get fixes out. Use whichever fits your use case...
- nitrogen 11y ago
  Maybe Wireshark isn't the best example, since it's a tool one tends to use to identify potentially malicious traffic in the first place.
  - m4r71n 11y ago
    Exactly! So why would you ever consider this to be a safe application, with or without the vulnerabilities? Wireshark should be used in a closed environment (VM) as should all tools that handle potentially malicious data.
- cwyers 11y ago
  Given the claim "Ubuntu has a number of vulnerabilities that are patched in Debian," I am unsure of how "Debian has unpatched vulnerabilities too" is supposed to make me feel better, given that Debian is an upstream of Ubuntu and so presumably those are ALSO unpatched in Ubuntu.
gkya 11y ago
Ubuntu is nice as a (1) desktop, but I can't see it's benefits as a server operating system. It's harder to configure, and more opaque than the alternatives. The devs seem amateurish and the company is too much unfocused for its size. The system is not well integrated and surprising changes occur frequently. Documentation is scarse and fragmented. There are systems like BSDs and maybe some Gnu Linux distros where the behaviour of the system and that the devs are way more predictable and processes and practices transparent. Why use Ubuntu for server, for other than its popularity and tradition? Is there actually any pros to it that I don't know? (1) Edit: Removed "disability" from here, autocorrect accident.
- rodionos 11y ago
  Ubuntu has done a really great job of getting its distributions into as many hands as possible. Consider these stats: - http://unix.stackexchange.com/questions/tagged/debian http://unix.stackexchange.com/questions/tagged/debian - 5K questions - http://stackexchange.com/sites?view=list#traffic http://stackexchange.com/sites?view=list#traffic - 224K questions
  - gkya 11y ago
    I meant technical benefits over other distros and Unix-likes.
    - cm-t 11y ago
      well, if you have snappy as a base, with secure features such as roll back on fail update (such as the kernel) will be there (not yet on LTS I think). If you need maas, juju (whitch of course can run on others distro), a system with 5 years of security updates without extra fees,
      - cyphar 11y ago
        You can get similar (and even more) features from openSUSE Leap.
- 11y ago
dfc 11y ago
Someone once asked me about wilders security. I told them I did not know much about it other than it was forum primarily for windows folks. I have never seen any discussions I wished I was part of from wilders. Is anyone familiar with wilders?
code_research 11y ago
There is only one really problematic package that is not supported in the current 16.04 release: network-manager-openvpn Please support the bug report on Launchpad: https://bugs.launchpad.net/ubuntu/+source/network-manager-openvpn/+bug/1574576 https://bugs.launchpad.net/ubuntu/+source/network-manager-op...
- jldugger 11y ago
  Are there open CVE's regarding it?
tbolt 11y ago
As someone who runs Ubuntu Desktop, should this be concerning? Currently I am running 14.04 which I keep regularly updated. The only other software I have installed is plex media server and chrome. Seems like I would be more at-risk if I were running more 'non-main' packages, but I am not really sure what that means.
- lamarkia 11y ago
  Such panic articles appear every so often. People have to dramatize in order to be heard. As a desktop user, you interact with the hostile Internet through your browser, which is updated as soon an issue appears. You might open PDF documents, so this is evince. Or Libreoffice for .doc. Both are in main and get security updates.
  - subsection1h 11y ago
    LibreOffice isn't in Main; it's in Universe. You've just unintentionally demonstrated how Ubuntu is less secure than many of its users realize.
- therealmarv 11y ago
  if you use software from universe you can check their support in the article linked. VLC is a good example. You need to check 1 by 1 if there is a new one
slizard 11y ago
While the point about the different level of support of different repos is a good one and it does deserve more awareness, without the right context the claims of the article are easy to mis- or over-interpret. I think a fair comparison would be to show other distros too rather than judge Ubuntu based on a single data-point. For instance, a user stuck with ancient packages on CentOS may quickly reach out to alternative repos and pull in tons of packages with questionable security.
fred_is_fred 11y ago
If we expect Ubuntu/Canonical to support universe packages then you should expect Apple to support all released OSX and iOS packages too. That would be insane, just like this article is.
slgeorge 11y ago
This title is misleading. The article is a post on a bulletin board by someone stating two facts: a. Canonical "claims" they provide Long Term Support b. That support is for the "Main" repository only. Neither of these points is incorrect: though "claim" clearly implies their opinion. All the Linux distributions need to draw the line somewhere on what software they will provide security for: Ubuntu comes from the Debian tradition which packages a large swathe of software, so to differentiate levels of support/origin they are separated into repositories. Other distributions reduce the total amount of packaged software made available, to deal with the same issue. The title is misleading because it implies that Ubuntu LTS' security record is poor: which this article is not discussing.

128 points by therealmarv 11y ago

To be fair, many packaged applications in popular distros are insecure (OwnCloud in Debian as one example). The developers of the applications will tell users specifically not to install the packaged version of the application, because it is out of date and/or insecure. PPAs were supposed to solve this problem, and the official line is that Snap packages are supposed to solve this problem, but better.

fulafel 11y ago
I don't remember ever seeing a ppa systematically handle security updates. It stands for "personal package archive" and lives up to its name... A rare few vendor ppas are frequently updated with the newest major version of the app for latest 1 or 2 LTS releases until they aren't, that's about the best I've seen.
ashitlerferad 11y ago
owncloud was removed from Debian.
- deleted 11y ago
  [deleted]
therealmarv 11y ago
snap is also not the silver bullet https://mjg59.dreamwidth.org/42320.html https://mjg59.dreamwidth.org/42320.html
- slgeorge 11y ago
  Snap packages with isolation aren't a 'silver bullet' but they are a step forward. It continues a trajectory of trying to secure desktop endusers with steps like AppArmor and kernel hardening that were don't for other LTS releases. At least in terms of package format, the difficulty with dpkg is that a) general software developers don't understand it, and b) it's not transactional in the sense you can't reverse what's happened easily. Trying to get commercial developers onto Linux is very difficult: on the desktop side they often don't see the point of such a small platform, and on the server side they feel it's super complicated and difficult. It might be stating the obvious but most developers aren't system administrators, so they really, really struggle with packaging and complain about dpkg/rpm a lot. Appstores are both tools and a process: Ubuntu did developer.ubuntu.com to provide an easy process for developers, and snap packages are another step along that way. Lets not let the perfect get in the way of the improved!

DyslexicAtheist 11y ago

"The thing is that those vulnerabilities are all fixed in Debian as all provided packages are maintained and security fixes are backported." Why can't Canonical move these fixes to Ubuntu LTS then? Seems the majority of the work (finding the cause, patching the code) was already done and corrections are sitting on some development branches from other distros.

rhinoceraptor 11y ago
Too busy working on a mobile platform that no one will ever use?
rlpb 11y ago
Ubuntu accepts contributed security updates for all packages, including for those in universe. Canonical only pro-actively monitors and pushes security updates for packages in main. Packages in universe gets security updates if and when they are contributed by the community. The "majority of the work" is done by upstream really, not other distros. The remaining work is backporting and QA which is distribution-specific, since the target versions (both of the package being updated and interactions with other packages that might be affected) are not necessarily the same.
kijin 11y ago
That's the problem with frozen releases. Upstream just moves ahead with new versions, but the distro insists on keeping the same version and only backporting a few patches. This might make sense for core packages that need to present a stable API throughout the lifecycle of an LTS release, but it creates a whole bunch of needless work for maintainers of other packages (who are often the same people who work upstream). Frozen distros are essentially telling them to create a frankenversion of their own program, one for each distro, based on some arbitrary version from several months or even years ago. Until a few years ago, most distros shipped a frozen version of Firefox and only backported important fixes. Ubuntu finally gave up and started shipping new versions of Firefox as soon as Mozilla releases them. I think they need to do the same with most of the packages in "universe", too, including the vast majority of GUI apps. No backporting, just pull the new version, build it, and run some tests. It would save a lot of duplicate work that every upstream is already doing, at negligible cost to the stability of the LTS release as a whole.

ausjke 11y ago

A bit scary but I understand ubuntu probably don't have the resource to watch all those packages all the time for verifying/backporting/testing etc. As far as security goes, Ubuntu really should work together with Debian to leverage each other to better the situation. My sites run either LTS or Debian and now I'm more worried.

lamarkia 11y ago
Not so much actual worry. Such panic articles appear regularly. If you stick with official packages, you are fine. It is the front-facing services that are important, and these are updated for security issues.
- ausjke 11y ago
  I ran those checks and most problematic packages are related to ruby, as I ran redmine which uses Ruby.

fulafel 11y ago

As there's already automatic(?) tracking for unfixed CVEs in "universe" at https://people.canonical.com/~ubuntu-security/cve/universe.html https://people.canonical.com/~ubuntu-security/cve/universe.h..., it would be a short step to a local tool that disables and/or warns users about running the programs when there are remote vulnerabilities. All in all it's pretty irresponsible to allow the current situation in the first place. Don't ship vulnerability-prone internet-facing C apps that you can't patch. I wonder what the patch situation in practice is with CentOS installs that enable EPEL?

embik 11y ago
> All in all it's pretty irresponsible to allow the current situation in the first place. Don't ship vulnerability-prone internet-facing C apps that you can't patch. I think it's even worse because they won't patch or remove it. They could, but they do not consider it a problem. Ubuntu just imports everything from Debian. Things not relevant to the core team at Canonical are just thrown at the community basically saying "if you want a safe OS, you have to support this by yourself now". All the while Canonical is building their in-house, partly closed-source solutions to already solved problems.
- slgeorge 11y ago
  That description of how Ubuntu deals with repositories is factually wrong. There are two repositories (in essense), Main and Universe [0]. For packages in Main a core developer (could be Canonical or someone else) has to be assigned to look after it and the Ubuntu security team has to allow it into the repository on the basis of it having a good security record and being maintainable [1]: it is _true_ that the Ubuntu security team is basically all Canonical employees. Many of these packages follow the upstream and don't come from Debian: or in some cases it's the same Canonical employee who maintains both the Debian and the Ubuntu packages so they might upload to Debian and pull in, or upload to both [2]. For Universe, Ubuntu pulls and builds from Debian. Many packages are sponsored by a maintainer who can then choose to upload their own package rather than use the latest sync from Debian. They aren't "thrown" to the community, rather they are never "promoted" to Main. All distributions have to choose how they deal with the large 'Universe' of software out there: in the Debian/Ubuntu world there's always been a lot of packages, compared to commercial RPM world. In Ubuntu's case the decision was to build/provide those packages, and let users decide what they wanted to do: for a 100% secured environment you would only turn on Main which is why the tools show you the supported status. The next question is whether it's a problem. It's not a problem if you understand a bit about how your distribution works. We can also look at the fact that it's been this way since Ubuntu started - so from 2004 it's worked like this. Clearly you don't like Ubuntu, which is fair enough: but I have to ask what you mean by "partly closed-source solutions" when there's nothing involving desktop Ubuntu that is closed-source. I assume you don't like Unity or something, but it's very much open source. Unless you are thinking of something else I'm unaware of? [0] https://help.ubuntu.com/community/Repositories/Ubuntu https://help.ubuntu.com/community/Repositories/Ubuntu [1] https://wiki.ubuntu.com/MainInclusionProcess https://wiki.ubuntu.com/MainInclusionProcess [2] https://www.piware.de/tag/debian/ https://www.piware.de/tag/debian/ is an example of someone who does this.

m4r71n 11y ago

I don't quite understand why people are upset with this. This is common in every, single Linux distro. Some vulnerabilities are simply not worth patching. Debian also has quite a few unpatched issues: https://security-tracker.debian.org/tracker/status/unreported https://security-tracker.debian.org/tracker/status/unreporte... And CentOS doesn't even publish that data because it would probably terrify you... The fact is that not all vulnerabilities are equal. Some silly crashing bug in Wireshark cannot be equated to an easily-exploitable RCE in some widely used library. I am pretty sure most of the latter are fixed everywhere, whereas the former should be ignored. If your use case really really requires fixing such low importance issues, then patch it yourself, or pay support fees to someone who will do it for you. And the fact that Debian patches some issues but Ubuntu does not is simply a question of how much work has been put into it. If a Debian pkg maintainer releases a new version, there is no guarantee that it doesn't break some other functionality. Simply patching without putting serious work into it is the trait of community distros like Debian and Fedora. Ubuntu, I assume, must go through a much more grueling process to get fixes out. Use whichever fits your use case...

nitrogen 11y ago
Maybe Wireshark isn't the best example, since it's a tool one tends to use to identify potentially malicious traffic in the first place.
- m4r71n 11y ago
  Exactly! So why would you ever consider this to be a safe application, with or without the vulnerabilities? Wireshark should be used in a closed environment (VM) as should all tools that handle potentially malicious data.
cwyers 11y ago
Given the claim "Ubuntu has a number of vulnerabilities that are patched in Debian," I am unsure of how "Debian has unpatched vulnerabilities too" is supposed to make me feel better, given that Debian is an upstream of Ubuntu and so presumably those are ALSO unpatched in Ubuntu.

gkya 11y ago

Ubuntu is nice as a (1) desktop, but I can't see it's benefits as a server operating system. It's harder to configure, and more opaque than the alternatives. The devs seem amateurish and the company is too much unfocused for its size. The system is not well integrated and surprising changes occur frequently. Documentation is scarse and fragmented. There are systems like BSDs and maybe some Gnu Linux distros where the behaviour of the system and that the devs are way more predictable and processes and practices transparent. Why use Ubuntu for server, for other than its popularity and tradition? Is there actually any pros to it that I don't know? (1) Edit: Removed "disability" from here, autocorrect accident.

rodionos 11y ago
Ubuntu has done a really great job of getting its distributions into as many hands as possible. Consider these stats: - http://unix.stackexchange.com/questions/tagged/debian http://unix.stackexchange.com/questions/tagged/debian - 5K questions - http://stackexchange.com/sites?view=list#traffic http://stackexchange.com/sites?view=list#traffic - 224K questions
- gkya 11y ago
  I meant technical benefits over other distros and Unix-likes.
  - cm-t 11y ago
    well, if you have snappy as a base, with secure features such as roll back on fail update (such as the kernel) will be there (not yet on LTS I think). If you need maas, juju (whitch of course can run on others distro), a system with 5 years of security updates without extra fees,
    - cyphar 11y ago
      You can get similar (and even more) features from openSUSE Leap.
11y ago

dfc 11y ago

Someone once asked me about wilders security. I told them I did not know much about it other than it was forum primarily for windows folks. I have never seen any discussions I wished I was part of from wilders. Is anyone familiar with wilders?

code_research 11y ago

There is only one really problematic package that is not supported in the current 16.04 release: network-manager-openvpn Please support the bug report on Launchpad: https://bugs.launchpad.net/ubuntu/+source/network-manager-openvpn/+bug/1574576 https://bugs.launchpad.net/ubuntu/+source/network-manager-op...

jldugger 11y ago
Are there open CVE's regarding it?

tbolt 11y ago

As someone who runs Ubuntu Desktop, should this be concerning? Currently I am running 14.04 which I keep regularly updated. The only other software I have installed is plex media server and chrome. Seems like I would be more at-risk if I were running more 'non-main' packages, but I am not really sure what that means.

lamarkia 11y ago
Such panic articles appear every so often. People have to dramatize in order to be heard. As a desktop user, you interact with the hostile Internet through your browser, which is updated as soon an issue appears. You might open PDF documents, so this is evince. Or Libreoffice for .doc. Both are in main and get security updates.
- subsection1h 11y ago
  LibreOffice isn't in Main; it's in Universe. You've just unintentionally demonstrated how Ubuntu is less secure than many of its users realize.
therealmarv 11y ago
if you use software from universe you can check their support in the article linked. VLC is a good example. You need to check 1 by 1 if there is a new one

slizard 11y ago

While the point about the different level of support of different repos is a good one and it does deserve more awareness, without the right context the claims of the article are easy to mis- or over-interpret. I think a fair comparison would be to show other distros too rather than judge Ubuntu based on a single data-point. For instance, a user stuck with ancient packages on CentOS may quickly reach out to alternative repos and pull in tons of packages with questionable security.

fred_is_fred 11y ago

If we expect Ubuntu/Canonical to support universe packages then you should expect Apple to support all released OSX and iOS packages too. That would be insane, just like this article is.

slgeorge 11y ago

This title is misleading. The article is a post on a bulletin board by someone stating two facts: a. Canonical "claims" they provide Long Term Support b. That support is for the "Main" repository only. Neither of these points is incorrect: though "claim" clearly implies their opinion. All the Linux distributions need to draw the line somewhere on what software they will provide security for: Ubuntu comes from the Debian tradition which packages a large swathe of software, so to differentiate levels of support/origin they are separated into repositories. Other distributions reduce the total amount of packaged software made available, to deal with the same issue. The title is misleading because it implies that Ubuntu LTS' security record is poor: which this article is not discussing.