Open-source News

In response to the decision to drop 32-bit x86 support beginning in Ubuntu 19.10, Alan Pope of Canonical and longtime Ubuntu member decided to try running some GOG games under an Ubuntu 19.10 daily build that he configured to remove the 32-bit packages ahead of the actual removal. Unfortunately, his experience didn't go so smoothly...

As another one of the prerequisites for landing the AMD Radeon RX 5000 series "Navi" support in Mesa, the libdrm bits have just been merged...

Install Handbrake on Linux to reduce video file sizes  H2S Media

HandBrake is a free & open source tool developed to convert videos from one formats to another . It is a cross-platform encoding tool (Windows, Mac & Linux).

Four CVEs Describe SACKs of Linux and FreeBSD ...  Dark Reading

Four new CVEs present issues that have a potential DoS impact on almost every Linux user.

Linux driver hints that more AMD Navi GPUs are on the way  PC Gamer

So far, AMD has only officially announced three Navi models, the Radeon RX 5700 XT and Radeon RX 5700, along with a 50th Anniversary Edition of the former ...

Ubuntu Linux Gets Intel MDS Mitigations for Intel Sandy Bridge CPUs, Update Now  Softpedia News

Users must update their systems as soon as possible.

Daily News Roundup: Malware in Your Pirated Software  How-To Geek

Researchers at ESET and Malwarebytes have discovered crypto mining malware hidden in pirated music production software. The pirated software loads the ...

Get the Pay What You Want: The Complete Linux eBook Bundle  BleepingComputer

A new pay what you want deal is available for 4 eBooks from Packt Publishing on how to secure Linux, perform shell scripting, Linux programming, and more.

The Latest Linux 5.2 + Mesa 19.2 Radeon Performance Against NVIDIA With Mid-Range GPUs  Phoronix

With the Linux 5.2 kernel a few weeks out from its stable release and now being in the middle of the Mesa 19.2 development cycle for the RADV Vulkan and ...

With the Linux 5.2 kernel a few weeks out from its stable release and now being in the middle of the Mesa 19.2 development cycle for the RADV Vulkan and RadeonSI OpenGL drivers, here are some fresh results looking at the latest open-source AMD Radeon Linux graphics driver stack compared to the latest NVIDIA proprietary graphics driver. In this article the focus is on the mid-range (Polaris) line-up against the NVIDIA competition while similar tests on the high-end are currently being carried out.

Jeff Woods  Linux Journal

Jeff Woods has worked in the IT field for more than 20 years, with broad experience in areas including software engineering, data engineering, operations, ...

Linux Certified System Administrator exam: User and group management  TechGenix

The Linux Certified System Administrator exam can be an important career step. Here's a close look at what is covered in user and group management.

Linux Certified System Administrator exam: User and group management  TechGenix

The Linux Certified System Administrator exam can be an important career step. Here's a close look at what is covered in user and group management.

Flameshot Linux: An open source screenshot tool for Linux  H2S Media

Flameshot, an annotate & screenshot shutter for Linux. It is a simple lightwieght Linux screenshot tool works on distros such as Ubuntu, CentOS, debian etc.

GNOME 3.33.3 is out this morning as the latest development release in the trek towards the very exciting GNOME 3.34 desktop update due out this September...

Linux display driver code hints that more AMD Navi GPUs are coming  The INQUIRER

IT LOOKS LIKE more AMD Navi Navi-based Radeon graphics cards are coming if snippets of info in Linux display driver code are anything to go by. Flagged by ...

If you are planning to enjoy some Linux gaming this week via Steam, you may want to think twice about upgrading to the latest Linux kernel Git code or even the newest stable point releases...

The Latest Linux Kernel Appears To Be Causing Connectivity Issues For Steam  Phoronix

If you are planning to enjoy some Linux gaming this week via Steam, you may want to think twice about upgrading to the latest Linux kernel Git code or even the ...

From: The Daily Swig

Patches released for latest builds, but older versions are still vulnerable

Several vulnerabilities in open source email suite Zimbra could be leveraged in a chained attack leading to remote code execution (RCE), a security researcher has found.

All versions of Zimbra are said to have been impacted, but the issue has now been fixed in 8.7.11 and 8.8x, the latest versions.

Researcher An Trinh (who goes by the Twitter handle @_tint0) said that Zimbra’s reliance of Extensible Markup Language (XML) for encoding its operations laid the path for multiple vulnerabilities – CVE-2016-9924, CVE-2018-20160, and CVE-2019-9670.

These are all XML external entity injection (XXE) vulnerabilities, which arise when applications process user-supplied XML documents without disabling references to external resources.

XML parsing often supports the use of external entities in order to check the validity of the data file through certain network protocols. An attacker can exploit this process in multiple ways, if any of part of its implementation is insecure.

“For more recent versions, CVE-2019-9670 works flawlessly where the XXE lies in the handling of Autodiscover requests,” Trinh said in a blog post published this week, explaining how the exploit could be leveraged on Zimbra versions 8.5 to 8.7.11.

“And for the sake of completeness, CVE-2018-20160 is an XXE in the handling of XMPP protocol and an additional bug along CVE-2019-9670 is a prevention bypass in the sanitizing of XHTML documents which also leads to XXE, however they both require some additional conditions to trigger,” Trinh said. “These all allow direct file extraction through response.”

Vulnerabilities like these can allow for privilege escalation and, in some cases, RCE, Trinh explained. Due to Zimbra’s token-based authentication method, an attacker needs access to the default admin port 7071, he said.

To complete the exploit chain an attacker makes use of another vulnerability – CVE-2019-9621 – for a work around to the admin port’s whitelist through ProxyServlet.doProxy().

“In short, if we send a request with 'foo:7071' Host header and a valid token in cookie, we can proxy a request to arbitrary targets that is otherwise only accessible to admins.”

A valid token is generated through a ‘hidden’ feature in Zimbra which can then provide access to the admin port, and the final requirement of the exploit chain attack to gain full control.

“The flow is to read the config file via XXE, generate a low-priv token through a normal AuthRequest, proxy an admin AuthRequest to the local admin port via ProxyServlet and finally, use the global admin token to upload a webshell via the ClientUploader extension,” Trinh said.

RCE via Memcached

RCE can also occur in Zimbra through an escalation of a Memcached injection vulnerability – as long as the email suite is using Memcached as its caching mechanism.

“The deserialization process happens at ImapMemcachedSerializer.deserialize() and triggers on ImapHandler.doSELECT() i.e. when a user invoking an IMAP SELECT command,” said Trinh.

“The IMAP port in most cases is publicly accessible, so we can safely assume the trigger of this exploit.”

Older versions of Zimbra are still impacted by all bugs, and users are advised to update.

The Daily Swig has reached out to Zimbra for comment.

Intel Drops 2 Exciting Clues About The Future Of Clear Linux OS For 'Normal' Desktop Users  Forbes

At first blush, Intel's Clear Linux OS Project may not seem like the ideal candidate for average desktop users. Expect that to change in the near future.