USN-6475-1: Cobbler vulnerabilities

Read Time:1 Minute, 8 Second

It was discovered that Cobbler did not properly handle user input, which
could result in an absolute path traversal. An attacker could possibly
use this issue to read arbitrary files. (CVE-2014-3225)

It was discovered that Cobbler did not properly handle user input, which
could result in command injection. An attacker could possibly use this
issue to execute arbitrary code with high privileges.
(CVE-2017-1000469, CVE-2021-45082)

It was discovered that Cobbler did not properly hide private functions in
a class. A remote attacker could possibly use this issue to gain high
privileges and upload files to an arbitrary location.
(CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)

Nicolas Chatelain discovered that Cobbler did not properly handle user
input, which could result in log poisoning. A remote attacker could
possibly use this issue to bypass authorization, write in an arbitrary
file, or execute arbitrary code.
(CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)

It was discovered that Cobbler did not properly handle file permissions
during package install or update operations. An attacker could possibly
use this issue to perform a privilege escalation attack. (CVE-2021-45083)

It was discovered that Cobbler did not properly process credentials for
expired accounts. An attacker could possibly use this issue to login to
the platform with an expired account or password. (CVE-2022-0860)

Read More

webkitgtk-2.42.2-1.fc37

Read Time:13 Second

FEDORA-2023-cb3cacfef8

Packages in this update:

webkitgtk-2.42.2-1.fc37

Update description:

Bump Safari version in user agent header.
Fix blob URL regression that broke many websites.
Fix several crashes and rendering issues.
Fix CVE-2023-41983 and CVE-2023-42852

Read More

Ten Ways AI Will Change Democracy

Read Time:6 Minute, 44 Second

Artificial intelligence will change so many aspects of society, largely in ways that we cannot conceive of yet. Democracy, and the systems of governance that surround it, will be no exception. In this short essay, I want to move beyond the “AI-generated disinformation” trope and speculate on some of the ways AI will change how democracy functions—in both large and small ways.

When I survey how artificial intelligence might upend different aspects of modern society, democracy included, I look at four different dimensions of change: speed, scale, scope, and sophistication. Look for places where changes in degree result in changes of kind. Those are where the societal upheavals will happen.

Some items on my list are still speculative, but none require science-fictional levels of technological advance. And we can see the first stages of many of them today. When reading about the successes and failures of AI systems, it’s important to differentiate between the fundamental limitations of AI as a technology, and the practical limitations of AI systems in the fall of 2023. Advances are happening quickly, and the impossible is becoming the routine. We don’t know how long this will continue, but my bet is on continued major technological advances in the coming years. Which means it’s going to be a wild ride.

So, here’s my list:

AI as educator. We are already seeing AI serving the role of teacher. It’s much more effective for a student to learn a topic from an interactive AI chatbot than from a textbook. This has applications for democracy. We can imagine chatbots teaching citizens about different issues, such as climate change or tax policy. We can imagine candidates deploying chatbots of themselves, allowing voters to directly engage with them on various issues. A more general chatbot could know the positions of all the candidates, and help voters decide which best represents their position. There are a lot of possibilities here.
AI as sense maker. There are many areas of society where accurate summarization is important. Today, when constituents write to their legislator, those letters get put into two piles—one for and another against—and someone compares the height of those piles. AI can do much better. It can provide a rich summary of the comments. It can help figure out which are unique and which are form letters. It can highlight unique perspectives. This same system can also work for comments to different government agencies on rulemaking processes—and on documents generated during the discovery process in lawsuits.
AI as moderator, mediator, and consensus builder. Imagine online conversations in which AIs serve the role of moderator. This could ensure that all voices are heard. It could block hateful—or even just off-topic—comments. It could highlight areas of agreement and disagreement. It could help the group reach a decision. This is nothing that a human moderator can’t do, but there aren’t enough human moderators to go around. AI can give this capability to every decision-making group. At the extreme, an AI could be an arbiter—a judge—weighing evidence and making a decision. These capabilities don’t exist yet, but they are not far off.
AI as lawmaker. We have already seen proposed legislation written by AI, albeit more as a stunt than anything else. But in the future AIs will help craft legislation, dealing with the complex ways laws interact with each other. More importantly, AIs will eventually be able to craft loopholes in legislation, ones potentially too complicated for people to easily notice. On the other side of that, AIs could be used to find loopholes in legislation—for both existing and pending laws. And more generally, AIs could be used to help develop policy positions.
AI as political strategist. Right now, you can ask your favorite chatbot questions about political strategy: what legislation would further your political goals, what positions to publicly take, what campaign slogans to use. The answers you get won’t be very good, but that’ll improve with time. In the future we should expect politicians to make use of this AI expertise: not to follow blindly, but as another source of ideas. And as AIs become more capable at using tools, they can automatically conduct polls and focus groups to test out political ideas. There are a lot of possibilities here. AIs could also engage in fundraising campaigns, directly soliciting contributions from people.
AI as lawyer. We don’t yet know which aspects of the legal profession can be done by AIs, but many routine tasks that are now handled by attorneys will soon be able to be completed by an AI. Early attempts at having AIs write legal briefs haven’t worked, but this will change as the systems get better at accuracy. Additionally, AIs can help people navigate government systems: filling out forms, applying for services, contesting bureaucratic actions. And future AIs will be much better at writing legalese, reducing the cost of legal counsel.
AI as cheap reasoning generator. More generally, AI chatbots are really good at generating persuasive arguments. Today, writing out a persuasive argument takes time and effort, and our systems reflect that. We can easily imagine AIs conducting lobbying campaigns, generating and submitting comments on legislation and rulemaking. This also has applications for the legal system. For example: if it is suddenly easy to file thousands of court cases, this will overwhelm the courts. Solutions for this are hard. We could increase the cost of filing a court case, but that becomes a burden on the poor. The only solution might be another AI working for the court, dealing with the deluge of AI-filed cases—which doesn’t sound like a great idea.
AI as law enforcer. Automated systems already act as law enforcement in some areas: speed trap cameras are an obvious example. AI can take this kind of thing much further, automatically identifying people who cheat on tax returns or when applying for government services. This has the obvious problem of false positives, which could be hard to contest if the courts believe that “the computer is always right.” Separately, future laws might be so complicated that only AIs are able to decide whether or not they are being broken. And, like breathalyzers, defendants might not be allowed to know how they work.
AI as propagandist. AIs can produce and distribute propaganda faster than humans can. This is an obvious risk, but we don’t know how effective any of it will be. It makes disinformation campaigns easier, which means that more people will take advantage of them. But people will be more inured against the risks. More importantly, AI’s ability to summarize and understand text can enable much more effective censorship.
AI as political proxy. Finally, we can imagine an AI voting on behalf of individuals. A voter could feed an AI their social, economic, and political preferences; or it can infer them by listening to them talk and watching their actions. And then it could be empowered to vote on their behalf, either for others who would represent them, or directly on ballot initiatives. On the one hand, this would greatly increase voter participation. On the other hand, it would further disengage people from the act of understanding politics and engaging in democracy.

When I teach AI policy at HKS, I stress the importance of separating the specific AI chatbot technologies in November of 2023 with AI’s technological possibilities in general. Some of the items on my list will soon be possible; others will remain fiction for many years. Similarly, our acceptance of these technologies will change. Items on that list that we would never accept today might feel routine in a few years. A judgeless courtroom seems crazy today, but so did a driverless car a few years ago. Don’t underestimate our ability to normalize new technologies. My bet is that we’re in for a wild ride.

This essay previously appeared on the Harvard Kennedy School Ash Center’s website.

Read More

A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution

Read Time:26 Second

A vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Read More

Securely disposing of old electronics and data: A forensic guide to protecting your information

Read Time:4 Minute, 40 Second

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. 

In our rapidly evolving digital landscape, the accumulation of old electronic devices is a common occurrence. Laptops, smartphones, external hard drives, and USB flash drives quickly become outdated and obsolete, yet they often contain a wealth of sensitive information. Safeguarding your personal and confidential data during the disposal process is of utmost importance. This article presents an in-depth guide on how to forensically dispose of old electronics and data, ensuring that your privacy and security are maintained at every step.

Back up and transfer data

Before you embark on the journey of disposing of an electronic device, it’s essential to initiate a thorough backup process. This backup serves two crucial purposes: preserving valuable data and enabling its transfer to a new device or storage medium. Here’s how to proceed:

Identify valuable data: Start by identifying and categorizing the data that you want to preserve. This includes documents, photos, music, and any other information that holds personal or professional significance.

Backup methods: Utilize a variety of backup methods to safeguard your data. These include external hard drives, cloud storage services, or network-attached storage (NAS) systems. Ensure that all data, including files stored in the cloud, is included in your backup.

Wipe your data

Once your data is securely backed up, the next step is to thoroughly wipe your electronic device to make any data unrecoverable by standard means. Depending on the type of device, follow these procedures:

A. Use data-wiping software:

Software options: Employ reputable data-wiping software such as DBAN (Darik’s Boot and Nuke), Eraser, or CCleaner.

Follow instructions: Carefully follow the instructions provided by the software to ensure your data is erased securely and unrecoverably.

B. Factory reset:

For mobile devices: Perform a factory reset on smartphones and tablets to erase all data and return the device to its original settings. Remember to remove any SIM cards or memory cards before initiating the reset.

C. Securely erase hard drives:

For computers and external hard drives: Use the Secure Erase feature for solid-state drives (SSDs) or employ the “shred” command on Linux systems for hard disk drives (HDDs).

Physical destruction

When dealing with devices that may still contain sensitive data or those that are too damaged or outdated to be wiped effectively, physical destruction is the most secure method to guarantee the protection of your data. Consider these approaches:

a. Smash or shred: Utilize a hammer, drill, or engage a professional shredding service to physically destroy hard drives, SSDs, and other storage devices. Ensure that the platters or chips are shattered beyond recovery.

b. Degaussing: Some companies offer degaussing services that employ strong magnets to erase data on magnetic media, such as tapes or older hard drives.

Dispose of electronics responsibly

After your data is securely wiped or destroyed, the final step is to dispose of your electronic devices in a responsible and environmentally friendly manner. To ensure responsible disposal, consider the following actions:

a. Recycle:

Many electronics retailers and recycling centers accept old devices for recycling. Look for e-waste recycling programs in your local area to ensure your old electronics do not end up in a landfill.

b. Trade-in or donate:

If your device is still in working condition, consider trading it in or donating it to a charitable organization. This practice promotes sustainability by extending the useful life of your electronics.

Best practices for secure data disposal

To maximize data security during the disposal process, consider implementing these best practices:

Use full disk encryption: Enable encryption on your devices to add an extra layer of security, making it more challenging for unauthorized parties to recover data even if the device is not securely wiped.

Keep records: Maintain detailed records of the devices you have disposed of, including serial numbers, date of disposal, and specifics about the data-wiping or destruction methods employed. These records serve as an audit trail for your data disposal process.

Physical locks and storage: Store old devices in a locked and secure location until they can be securely disposed of. This extra layer of physical security minimizes the risk of unauthorized access to your data.

Regular data audits: Perform periodic data audits to identify and remove data that is no longer needed. This practice reduces the risk of data exposure during the disposal of old electronics.

Resources

To assist you in your journey of securely disposing of old electronics and data, the following resources are available:

Data-Wiping Tools:

Darik’s Boot and Nuke (DBAN): https://dban.org/

Eraser: https://eraser.heidi.ie/

CCleaner: https://www.ccleaner.com/

E-Waste Recycling Programs:

Earth911: https://earth911.com/

Call2Recycle: https://www.call2recycle.org/

E-Stewards Certified Recyclers: https://e-stewards.org/find-a-recycler/

Professional data destruction services:

Shredding services: Seek out local shredding companies for secure data destruction.

Degaussing services: Explore data destruction companies that offer degaussing services.

Conclusion

The secure disposal of old electronics and data is an imperative task in a world where data privacy is so critical. By following the outlined steps in this article, which encompass data backup, secure data wiping, physical destruction, and responsible disposal, you can confidently eliminate the risk of data breaches when parting ways with your old electronic devices. It is essential to adhere to best practices and make use of the available resources to ensure that your data remains inaccessible to unauthorized individuals, ultimately safeguarding your privacy and security.

Read More

DSA-5553-1 postgresql-15 – security update

Read Time:40 Second

Several vulnerabilities have been discovered in the PostgreSQL
database system.

CVE-2023-5868

Jingzhou Fu discovered a memory disclosure flaw in aggregate
function calls.

CVE-2023-5869

Pedro Gallegos reported integer overflow flaws resulting in buffer
overflows in the array modification functions.

CVE-2023-5870

Hemanth Sandrana and Mahendrakar Srinivasarao reported that the
pg_cancel_backend role can signal certain superuser processes,
potentially resulting in denial of service.

CVE-2023-39417

Micah Gate, Valerie Woolard, Tim Carey-Smith, and Christoph Berg
reported that an extension script using @substitutions@ within
quoting may allow to perform an SQL injection for an attacker having
database-level CREATE privileges.

CVE-2023-39418

Dean Rasheed reported that the MERGE command to enforce UPDATE or
SELECT row security policies.

https://security-tracker.debian.org/tracker/DSA-5553-1

Read More

DSA-5554-1 postgresql-13 – security update

Read Time:34 Second

Several vulnerabilities have been discovered in the PostgreSQL
database system.

CVE-2023-5868

Jingzhou Fu discovered a memory disclosure flaw in aggregate
function calls.

CVE-2023-5869

Pedro Gallegos reported integer overflow flaws resulting in buffer
overflows in the array modification functions.

CVE-2023-5870

Hemanth Sandrana and Mahendrakar Srinivasarao reported that the
pg_cancel_backend role can signal certain superuser processes,
potentially resulting in denial of service.

CVE-2023-39417

Micah Gate, Valerie Woolard, Tim Carey-Smith, and Christoph Berg
reported that an extension script using @substitutions@ within
quoting may allow to perform an SQL injection for an attacker having
database-level CREATE privileges.

https://security-tracker.debian.org/tracker/DSA-5554-1

Read More