ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

WebKit security holes haunt Ubuntu

By | August 24, 2011, 12:10pm PDT

Summary: According to an Ubuntu security alert, the WebKit flaws are dangerous enough to cause arbitrary code execution attacks.

The Ubuntu Linux operating system has been refreshed to fix multiple WebKit flaws that expose users to malicious hacker attacks.

According to an Ubuntu security alert, the flaws are dangerous enough to cause arbitrary code execution attacks.

From the alert:

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

follow Ryan Naraine on twitter

Ubuntu documents 22 different vulnerabilities affecting Ubuntu 10.10 and Ubuntu 10.04 LTS.

A separate vulnerability in the open-source operating system was also fixed to block an issue that lets attackers use eCryptfs to unmount arbitrary locations and cause a denial-of-service condition.

It was discovered that eCryptfs incorrectly handled permissions whenmodifying the mtab file. A local attacker could use this flaw to manipulate the mtab file, and possibly unmount arbitrary locations, leading to a denial of service.

The ecryptfs-utils vulnerability affects Ubuntu 11.04, Ubuntu 10.10 and Ubuntu 10.04 LTS.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
49
Comments

Join the conversation!

Just In

RE: WebKit security holes haunt Ubuntu
tmsbrdrs 21st Nov
@rick@...
Maybe you should reread my reply.

I was actually responding to your own comments. For example, the very phrase "linux dorks" is just wrong. We're geeks, we're nerds, we're not dorks.
Your use of Loverock as a source, as another example, shows your ignorance of these forums in general. Loverock tends to make the most asinine comments about Linux and claims that Windows is so much more secure. Truth is, I've had to fix, troubleshoot and simply live with the inherent insecurities of the current batch of Windows systems for as long as I can remember. That's the main reason I switched over to Linux in the first place.

When you respond specifically to another user, that's one thing. When you make comments which take linux users in general into account, that's another and yes, I'll respond to them to point out your general lack of respect for us "ordinary linux users". Just a hint, the majority of us are what you attempted to call "linux dorks".
0 Votes
+ -
Good work Ryan
Dietrich T. Schmitz * Your Linux Advocate 24th Aug
I can't find you on Google Plus--are you there?
0 Votes
+ -
Contributr
>>>I can't find you on Google Plus--are you there?

Nay. No social networks for me. Only http://twitter.com/ryanaraine
0 Votes
+ -
"No social networks for me.
Rabid Howler Monkey 24th Aug
@Ryan Naraine This statement is very interesting coming from one of ZDNet's security writers. Is there a security reason behind this? If so, it would make for interesting reading.

P.S. Apologies for off-topic post.
0 Votes
+ -
@Ryan: instead of trying to just spread FUD
thx-1138_@... Updated - 28th Aug
@Ryan Naraine .. why didn't you include any mitigation strategies for those folk that use Ubuntu 10.xx (or later)?!? Oh, i almost forgot .. ZDNet is an online tabloid.

Because let's face it, if you were genuinely concerned with the implications of the vulnerabilities, you would have .. but since you're obviously working with an agenda, hey .. that gets you page hits via click bait - and zero credibility.

So without further ado, for those that got absolutely nothing from Ryan's crappy write-up in the way of mitigation strategies, try some basic, self-help steps:

(1) Ensure you install the auto updates (these will typically be alerted to you shortly after Ubuntu starts up - via a pop up alert).

(2) Open an instance of the terminal / console and check the status of all apparmor profiles, by typing at the prompt:

sudo apparmor_status

then press 'return' (Enter)

(3) If you haven't already, for Konqueror and Chrome (if you have Chrome installed), you can (actually I highly recommend you do) put both profiles in enforce mode:

example:

sudo aa-enforce /path/to/bin

(where you replace '/path/to' with the path to the application profile - and any related profiles: for example, Chrome can have 1 primary and anywhere between 3-4 related, sub-profiles)

Once this is complete, exit the console. Having carried out these steps, you will have gone a long way towards ensuring attack vectors like this are dead to rights.

Regards
0 Votes
+ -
@Dietrich T. Schmitz * Your Linux Advocate
G+ is dead.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
ItsTheBottomLine 25th Aug
@biobiobio he needs a tissue for the nose.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
FuzzyBunnySlippers 24th Aug
@Dietrich T. Schmitz * Your Linux Advocate

Crickets, huh? LOL
0 Votes
+ -
@Dietrich T. Schmitz * Your Linux Advocate
Dietrich, let me ask you - if one is using Firefox as their browser in Ubuntu, is Webkit still in the picture?
0 Votes
+ -
Very cool! Thanks for sharing happy replica watches
0 Votes
+ -
that's FUD
The Linux Geek 24th Aug
since they are already patched.
0 Votes
+ -
Yes, but when did Ryan last write anything about Ubuntu?
Dietrich T. Schmitz * Your Linux Advocate 24th Aug
@The Linux Geek

He reports with the word 'refresh' at the top of his post.
0 Votes
+ -
@The Linux Geek Tell me again about conficker and other Microsoft ghost stories that you tell around the campfire.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
Rabid Howler Monkey Updated - 24th Aug
@facebook@... The Linux Geek doesn't need a campfire to generate hot air.

@The Linux Geek Canonical may have generated the patches for Ubuntu, but the users still need to apply them to their systems. Consider this warning a heads up, just like with Windows and Mac OS X patches.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
techadmin.cc@... Updated - 25th Aug
@The Linux Geek

I don't think Ryan was trying to spread FUD so much as he was trying to inform, however, upon reading this article I just knew (maybe I'm a touch psychic?) that the Linux hater's would jump all over this citing that Linux isn't more secure after all.

Trolls and MS fanbois, more secure does not suggest completely secure. If any Linux fanboi tries to tell you Linux is completely secure just ignore them. They either don't know what they are talking about or are deliberately baiting you to see if you can make some equally ridiculous statements. You seldom disappoint.

I'll clarify a few points though on the scope and severity of these security holes. Webkit is not Linux. It is a browser component that runs on Windows and Mac as well. JavaScript too, is cross platform code that has been known for its occasional security holes on all platforms including Microsoft and Apple.

The eCryptfs issue would only affect servers using eCryptfs encrypted file systems and, read carefully: "A local attacker could use this flaw to manipulate the mtab file, and possibly unmount arbitrary locations, leading to a denial of service." Local meaning someone with local access to the server which would require some other breach of security to gain.
0 Votes
+ -
@The Linux Geek I do get a kick out of reading the posts from the various Linux Dorks here. It's especially funny how you guys love to rant and rave about Windows flaws that were patched years ago, as if they still matter, but then it is "spreading FUD" to talk about a Linux flaw that was only patched very recently.

Every time there is a "Patch Tuesday" article here, you guys jump all over it, criticizing Windows for having the flaws that are being patched. And when someone like Loverock Davidson points out that those flaws are "non-issues" now because they have been patched, you call him an idiot. Yet, here we have an article talking about Linux flaws that have been patched, and you immediately declare that this is "spreading FUD" to talk about flaws that have been patched.

And of course, even though I am neither a "Linux hater," nor a "Windows Fanboi" by any stretch of the imagination, I will be accused of such simply for pointing out how foolish you Linux Dorks make yourselves look with your endless claims that Linux can't possibly attacked under any circumstances, and your constant denial of the fact that Linux can, and does have security flaws that simply haven't been discovered yet. Clearly, the flaws that were reported in Ryan's article existed for sometime before they were patched. Just because they weren't discovered until recently doesn't mean they didn't exist. Just because no one bother to use these flaws to launch an attack on an OS that no one uses doesn't mean it was not possible to do. But of course, I know that I am going way over your head with big words and complicated concepts, so I know what I am saying will not make sense to you.

Oh well, your endless stupidity does make for some very entertaining reading, so keep up the good work!

Rick
0 Votes
+ -
@rick@...
Guessing you're a windows fanboy then. Just for future reference, you might not want to claim Loverock as a source of anything other than amusement.

Also, when claiming you're not a linux hater, it helps if you don't call others "linux dorks". I'm a Linux user. I gladly call myself a nerd but I will not allow you to continue your ignorance and call me a dork.

I've never seen a valid post (i.e. a post not pointed out by other linux users) claiming that Linux is 100% impervious to attack. I have, however, seen plenty of posts claiming Apple is impervious and quite a few extremely ignorant posts claiming Windows to now be very much impervious, until the next patch tuesday when several arbitrary code execution vulnerabilities are exposed.
0 Votes
+ -
@tmsbrdrs Interesting that you read a post directed towards Linux Geek and assumed it was directed towards all Linux users, including yourself. I'm sorry that you cannot tell the difference between a normal person who happens to use Linux, compared to someone like Linux Geek, who constantly spews nonsense about the holy wonders of Linux and the horrible evils of Windows.

Ok, Windows happens to work for me. I also happen to drive a Ford truck. And I like Pepsi better than Coke. So what. Those are my preference. Your preferences may be different. The great thing about the world we live in is that we all have many options to choose from. You can use the OS you prefer, and I can use the OS I prefer. You can drive the vehicle you prefer, and I can drive the one that I prefer.

The "Linux Dork" is someone like Linux Geek, Or DTS Your Linux Advocate. The "Linux Dork" is one who has nothing better to do with his life but spend all day posting stupid crap about how wonderful Linux is, while at the same time making up all kinds of absurd claims about how horrible Windows is.

The only reason I mentioned Loverock Davidson was to point out how Linux Geek is doing the exact same thing here (claiming that this Linux flaw is a "non-issue" because it has been patched) as LD does all the time when he claims that Windows flaws are "non-issues" once they have been patched. I did not claim him as a source of anything. But perhaps in your haste to attack me for being critical of a certain Linux Dork, you overlooked that fact.

Obviously, what it comes down to is that there is a huge double standard here, where every Windows flaw that has ever existed still "counts" against Windows, regardless if it has been patched or not. On the other hand, it is "spreading FUD" to talk about a Linux flaw after it has been patched. It is exactly these double standards that all Linux Dorks depend on to convince themselves of the fantasy they want to believe in. And yes, Mac Fanbois depend on similar double standards in order to support the fantasy world they live in.

Anyone who claims any of the major OSes in the world are impervious to attack is a fool. A modern OS is way too complex to ever be 100% foolproof. As I pointed out in my first post, the reality of it is that the Linux flaws addressed in this article existed in Linux before they were discovered. Just because they hadn't been discovered doesn't mean they did not exist. In the same way, I can guarantee that Linux has still more flaws that have yet to be discovered, but none the less, they do exist. The same is true for Windows, Mac OS, AIX, Solaris, z/OS, and any other OS you can think of.

Whether you want to admit it or not, the reality of the world is that Windows is the most popular OS on the planet. More people use Windows than any other OS. More people know how to write code for Windows. More people understand the inner workings of Windows. More people are interested in hacking into Windows. More people are writing malware for Windows. And, at the end of the day, the bottom line is that more people are going to discover more flaws in Windows than any other OS. You can pretend all you want that the reason Windows gets attacked more is because it is less secure, but that is like me pretending my house is more secure than a bank, because, after all, the bank in my neighborhood has been robbed at least 3 or 4 times in the 20 years I've lived here, while my house has never been robbed once.

So, pretend all you want. Enjoy the fantasy land you live in. Meanwhile, the rest of us will face reality and deal with facts.

Rick
0 Votes
+ -
@rick@...
Maybe you should reread my reply.

I was actually responding to your own comments. For example, the very phrase "linux dorks" is just wrong. We're geeks, we're nerds, we're not dorks.
Your use of Loverock as a source, as another example, shows your ignorance of these forums in general. Loverock tends to make the most asinine comments about Linux and claims that Windows is so much more secure. Truth is, I've had to fix, troubleshoot and simply live with the inherent insecurities of the current batch of Windows systems for as long as I can remember. That's the main reason I switched over to Linux in the first place.

When you respond specifically to another user, that's one thing. When you make comments which take linux users in general into account, that's another and yes, I'll respond to them to point out your general lack of respect for us "ordinary linux users". Just a hint, the majority of us are what you attempted to call "linux dorks".
0 Votes
+ -
Whats the overall impact?
smartobject 24th Aug
Does this apply to webkit browsers that may be pointing to ubuntu servers without the security patch ?
Thanks
0 Votes
+ -
That cannot be right
facebook@... 24th Aug
Linux is the safest operating system in the world. Someone with experience with only two operating systems once staked his reputation on it.
0 Votes
+ -
Hush.
UrNotPayingAttention 24th Aug
@facebook@...

Even Fort Knox has it's vulnerabilities... that doesn't mean it's getting owned anytime soon.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
ItsTheBottomLine 25th Aug
@chmod 777 Careful there hot shot that was a very accurate jab at repu boy.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
kris_stapley@... 25th Aug
@facebook@...
Too funny happy
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
ItsTheBottomLine 25th Aug
@facebook@... LOL
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
LoverockDavidson_-24231404894599612871915491754222 24th Aug
Another reason for me not to use linux. Canonical is really on a roll with making themselves look foolish lately.
0 Votes
+ -
@LoverockDavidson_

I guess you would rather use that other OS where vulnerabilities go unpatched.
0 Votes
+ -
@guzz46 No need to bring that other OS into this discussion at all. Their CEO just retired. Besides, they built their Safari browser on Webkit too.
0 Votes
+ -
@facebook@...

Are you implying that Loverock uses OS X instead of Windows?
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
LoverockDavidson_-24231404894599612871915491754222 24th Aug
@guzz46
Not sure what OS you are talking about the OS I use gets patched. Only linux users are in denial about an OS not needing patches even though they get them daily.
0 Votes
+ -
@LoverockDavidson_

It is a shame that some Windows users become so narrow-minded that they are then blinded by their hatred for anything different.
0 Votes
+ -
You're so right Daikon. Folks don't hate me because I am beautiful.
Dietrich T. Schmitz * Your Linux Advocate 24th Aug
@daikon
nt
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
LoverockDavidson_-24231404894599612871915491754222 24th Aug
@daikon
I'm not narrow minded when my eyes are wide open to the fallacies involved with linux.
0 Votes
+ -
Love, What fallacies involved with Linux do you speak of.
right Loverock ? and than post right? Lovie happy
0 Votes
+ -
the OS I use gets patched
guzz46 24th Aug
@LoverockDavidson_

Then you must be using Linux, because there are currently 5 unpatched vulnerabilities for Windows 7

http://secunia.com/advisories/product/27467/?task=advisories

Quote "The most severe unpatched Secunia advisory affecting Microsoft Windows 7, with all vendor patches applied, is rated Highly critical"
0 Votes
+ -
@LoverockDavidson_ - Yes between this and the telnet port I guess you have been correct all along.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
james.vandamme 25th Aug
@LoverockDavidson_ Man bites dog: that's news. Windows has holes, not news.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
andrewsomething Updated - 24th Aug
Why is this being billed as specifically an issue with Ubuntu? Click through, this looks like these issues effected upstream webkit, Google Chrome, Red Hat, Fedora, SUSE, ect...
0 Votes
+ -
@andrewsomething
From the looks of it, it's actually a good thing. Ubuntu is pushing out the patches while the rest are playing catch-up. At least, judging from this particular article.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
Rabid Howler Monkey 29th Aug
@tmsbrdrs Actually, Canonical is way behind everyone else with this patch because it, somehow, fell between the cracks. The vulnerabilities were originally written up in May, 2010:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1824

thx-1138_@'s post above is spot-on. Sandboxing one's browser(s) helps to protect against late patching (in this particular case) as well as 0-day vulnerabilities unknown to the devs.
0 Votes
+ -
This isn't ubuntu's problem
rnicholl1 24th Aug
Please note:
Webkit is used in:
Safari
Google Chrome
And shows up in:
Windows
Mac
all Linux (including non-ubuntu)
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
FuzzyBunnySlippers 24th Aug
Wait, what? So, exactly 'when' should I start believing Linux is more secure? Two years ago when I was told that, one year ago, now, or after the next patch?
@FuzzyBunnySlippers

Now, but you can still choose not to believe it if you wish but that won't change the facts, if someone still believes that the world is square that doesn't actually mean that the world is square.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
FuzzyBunnySlippers Updated - 24th Aug
@Dietrich T. Schmitz * Your Linux Advocate

Your unexplained, unmitigated, and even unfounded "nt's" as a knee-jek response are becoming an obvious attempt at disguising a lazy, C'est la vie response to empirically backing up even your own statements with any evidence. Many are beginning to wonder if you have any true response other than preconcieved notions and wholesale dismissal of truth. Please do yourself a favor, as well as any that would value your opinion and expound further with at least some, any, intelligent counterpoints. Your reputation is floundering at this point.
@FuzzyBunnySlippers---'Your reputation is floundering at this point,' In who's maybe arrogant viewpoint. Yours? But, not mine, or a whole bunch of other people.
DTS consistently, articulately, even at length sometimes lets his viewpoint be plainly known to all who will hear, and to even some who'd rather not.
There's no need for him to repeat every single time just where he stands. We regulars know by now, by heart.
So, this being so, what was your point? If he's floundering, you need to come up for a breath of fresh air.
BTW, did you catch DTS rightly lauding Ed Bott's sage advice to MS Window's users. He explained himself quite well there. And so did Ed.
0 Votes
+ -
Would these vulnerabilities affect Linux Mint v10 or v11?
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
Rabid Howler Monkey 25th Aug
@J Hartsock See this Ubuntu Security Notice (copied from Ryan's blog):

http://www.ubuntu.com/usn/usn-1195-1/

It applies to Ubuntu releases 10.04/10.10 and it's derivatives. Is the version of Mint you're using derived from one of these two Ubuntu releases?
0 Votes
+ -
Oh no! A patch! That must mean the OS is inherently unsafe! Run away!!! Run away!!!

Give me a break. Any OS that never needs a patch was probably created by God/Flying Spaghetti Monster/Insert Diety Name Here. If its made by Man, it's flawed like Man.
0 Votes
+ -
RE: WebKit security holes haunt Ubuntu
AndrewWhitehall Updated - 26th Aug
linux servers are hacked on a regular basis, always have been , always will be, fact

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix