Software liability reform is liable to push us off a cliff

Read Time:28 Second

Like “SBOMs will solve everything,” there is a regular cry to reform software liability, specifically in the case of products with insecurities and vulnerabilities. US Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly’s comments this week brought the topic back into focus, but it’s still a thorny issue. (There’s a reason certain things are called “wicked problems.”) The proposed remedy, taking up a full page of the Biden Administration’s National Cybersecurity Strategy, will cause more problems than it solves.

To read this article in full, please click here

Read More

USN-5909-1: Linux kernel (Azure CVM) vulnerabilities

Read Time:1 Minute, 34 Second

It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux
kernel did not properly perform bounds checking in some situations. A
physically proximate attacker could use this to craft a malicious USB
device that when inserted, could cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-3628)

It was discovered that a use-after-free vulnerability existed in the
Bluetooth stack in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2022-3640)

Khalid Masum discovered that the NILFS2 file system implementation in the
Linux kernel did not properly handle certain error conditions, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service or possibly execute arbitrary code. (CVE-2022-3649)

It was discovered that a race condition existed in the SMSC UFX USB driver
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A physically proximate attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2022-41849)

It was discovered that a race condition existed in the Roccat HID driver in
the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2022-41850)

Tamás Koczka discovered that the Bluetooth L2CAP implementation in the
Linux kernel did not properly initialize memory in some situations. A
physically proximate attacker could possibly use this to expose sensitive
information (kernel memory). (CVE-2022-42895)

It was discovered that the binder IPC implementation in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-20928)

Read More

Trezor crypto wallets under attack in SMS phishing campaign

Read Time:20 Second

Willie Sutton, the criminal who became legendary for stealing from banks during a forty year career, was once asked, “Why do you keep robbing banks?”

His answer? “Because that’s where the money is.”

However, today there’s a better target for robbers today than banks, which are typically well-defended against theft…

Cryptocurrency wallets.

Read more in my article on the Tripwire State of Security blog.

Read More

USN-5821-4: pip regression

Read Time:21 Second

USN-5821-3 fixed a vulnerability in pip. The update introduced
a minor regression in Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and
Ubuntu 18.04 LTS. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Sebastian Chnelik discovered that wheel incorrectly handled
certain file names when validated against a regex expression.
An attacker could possibly use this issue to cause a
denial of service.

Read More

nodejs16-16.19.1-4.fc37

Read Time:1 Minute, 45 Second

FEDORA-2023-dc70a91343

Packages in this update:

nodejs16-16.19.1-4.fc37

Update description:

2023-02-16, Version 16.19.1 ‘Gallium’ (LTS), @richardlau

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

Fixed by an update to undici:

CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
See https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff for more information.
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
See https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w for more information.

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.

Commits

[7fef050447] – build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
[b558e9f476] – crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
[160adb7ffc] – crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
[d0ece30948] – crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
[2d9ae4f184] – deps: update undici to v5.19.1 (Matteo Collina) nodejs-private/node-private#388
[d80e8312fd] – deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46568
[de5c8d2c2f] – deps: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) #46568
[1a8ccfe908] – deps: upgrade openssl sources to OpenSSL_1_1_1t+quic (RafaelGSS) #46568
[693789780b] – doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #45846
[f95ef064f4] – lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
[b02d895137] – policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
[d7f83c420c] – test: avoid left behind child processes (Richard Lau) #46276

Read More

nodejs16-16.19.1-4.fc38

Read Time:1 Minute, 45 Second

FEDORA-2023-3a6f96ad55

Packages in this update:

nodejs16-16.19.1-4.fc38

Update description:

2023-02-16, Version 16.19.1 ‘Gallium’ (LTS), @richardlau

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

Fixed by an update to undici:

CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
See https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff for more information.
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
See https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w for more information.

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.

Commits

[7fef050447] – build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
[b558e9f476] – crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
[160adb7ffc] – crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
[d0ece30948] – crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
[2d9ae4f184] – deps: update undici to v5.19.1 (Matteo Collina) nodejs-private/node-private#388
[d80e8312fd] – deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46568
[de5c8d2c2f] – deps: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) #46568
[1a8ccfe908] – deps: upgrade openssl sources to OpenSSL_1_1_1t+quic (RafaelGSS) #46568
[693789780b] – doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #45846
[f95ef064f4] – lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
[b02d895137] – policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
[d7f83c420c] – test: avoid left behind child processes (Richard Lau) #46276

Read More

Booking.com account takeover flaw shows possible pitfalls in OAuth implementations

Read Time:52 Second

Booking.com, one of the world’s largest online travel agencies, recently patched a vulnerability in its implementation of the OAuth protocol that could have allowed attackers to gain access to customer accounts by simply tricking them into clicking a link. The attack combined three separate issues that on their own could be categorized as low risk and could be introduced by many developers into their implementations.

“For the OAuth issues we found, had a bad actor discovered and successfully exploited them, that attacker could have taken over the accounts of users logging in via Facebook,” researchers from Salt Security, a company that specializes in securing APIs, said in their report. “Once logged in, the attacker could have performed any action on behalf of the compromised users and gain full visibility into the account, including and all of a user’s personal information. Our research found that attackers could then use the compromised booking.com login to also log into sister company Kayak.com.”

To read this article in full, please click here

Read More