Linux admins - today, we're seeing multiple significant vulnerabilities in Thunderbird that threat actors are using to steal sensitive data and take control over vulnerable servers. Malicious actors could exploit these vulnerabilities to disrupt services and steal data. The article I link to here contains the technical details you may want to know about these flaws.

Read on to learn how to patch this flaw and find out about other impactful vulnerabilities recently found and fixed in your open-source programs and applications. 

If you gained valuable information from reading today’s newsletter, please share it with a fellow security geek. Do you have a Linux security-related topic you'd like to cover for our audience? We welcome contributions from passionate, knowledgeable community members who share our love for Linux and security!

Stay safe out there,

Brittany Signature 150

Thunderbird 

The Discovery 

Several significant vulnerabilities have been found in the popular open-source Thunderbird email client. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could exploit these issues to cause a denial of service, obtain sensitive data, bypass security restrictions, perform cross-site tracing, or execute arbitrary code.

Thunderbird

The Impact

Exploitation of these bugs could result in the compromise of sensitive information or loss of system availability.

The Fix

A critical update for Thunderbird has been released to fix these damaging flaws. Given these vulnerabilities’ severe threat to affected systems, if left unpatched, we strongly recommend all impacted users update immediately to protect against data theft and loss of system access.

Your Related Advisories:

Register to Customize Your Advisories

Linux Kernel

The Discovery 

Have you updated to mitigate the severe flaws found in the Linux kernel? The most significant is a new kernel vulnerability that could allow attackers to gain root privileges on affected systems. The vulnerability, tracked as CVE-2024-0193, is a use-after-free flaw found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local, unprivileged user with CAP_NET_ADMIN capability to escalate privileges on the target system.

LinuxKernel

The Impact

Since this bug allows privilege escalation, attackers could use it to gain root system access. This could enable them to view additional infrastructure to attack, add or delete users, or modify permissions of files or other users.

The Fix

An essential Linux kernel security update has been released to fix the recently discovered issues. Given the above vulnerability’s threat to affected systems, if left unpatched, we urge all impacted users to update as soon as possible. Patching will protect against attacks potentially leading to system downtime or compromise.

Your Related Advisories:

Register to Customize Your Advisories

OpenSSH

The Discovery 

Following the infamous “Terrapin vulnerability,” which allows a man-in-the-middle (MITM) attacker to access impacted users’ sensitive information in transit, another severe vulnerability has been found in OpenSSH. It was discovered that OpenSSH incorrectly handled supplemental groups when running helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand as a different user. An attacker could exploit this issue to escalate privileges on affected systems (CVE-2021-41617). 

OpenSSH

The Impact

This issue could result in privilege escalation attacks, enabling malicious hackers to view additional infrastructure to attack, add or delete users, or modify permissions of files or other users.

The Fix

Distros continue to release updates for OpenSSH to mitigate the recent flaws that have been identified. Given these vulnerabilities’ severe threat to affected systems, if left unpatched, we strongly recommend all impacted users update now to defend against privilege escalation on their systems and secure their critical data.

Your Related Advisories:

Register to Customize Your Advisories