Security Leftovers

posted by Roy Schestowitz on Aug 15, 2022

• Google Boosts Bug Bounty Rewards for Linux Kernel Vulnerabilities [Ed: This is the very same Google that put NSA-weakened encryption inside the Linux kernel before it got yanked out months later]

  Google is once again boosting the maximum bounty payouts for Linux vulnerabilities reported as part of its open-source Kubernetes-based capture-the-flag (CTF) vulnerability rewards program (VRP).

  Called kCTF, the program was launched in 2020 to provide security researchers with the means to report vulnerabilities in the Google Kubernetes Engine (GKE), for which they receive a flag.

  “All of GKE and its dependencies are in scope, but every flag caught so far has been a container breakout through a Linux kernel vulnerability. We’ve learned that finding and exploiting heap memory corruption vulnerabilities in the Linux kernel could be made a lot harder,” Google notes.

• PostgreSQL: PostgreSQL JDBC versions 42.4.1/42.2.26 Security Update

  The PostgreSQL JDBC team have released 42.2.26 and 42.4.1 to address a security issue: CVE-2022-31197. This is only an issue if you are using ResultSet.refreshRow()

  Previously, the column names for both key and data columns in the table were copied as-is into the generated SQL. This allowed a malicious table with column names that include statement terminator to be parsed and executed as multiple separate commands. More information about this security advisory is available here

  Thanks to Sho Kato https://github.com/kato-sho for finding and reporting the issue

• Security updates for Monday

  Security updates have been issued by Debian (trafficserver), Fedora (freeciv, gnutls, kernel, libldb, mingw-gdk-pixbuf, owncloud-client, rust-ffsend, samba, thunderbird, and zlib), Gentoo (apache, binutils, chromium, glibc, gstreamer, libarchive, libebml, nokogiri, puma, qemu, xen, and xterm), Mageia (golang, libtiff, poppler, python-django, and ruby-sinatra), Red Hat (.NET 6.0 and .NET Core 3.1), SUSE (chromium, cifs-utils, kernel, open-iscsi, and trousers), and Ubuntu (webkit2gtk).

• $23 Million YouTube Royalties Scam

  Scammers were able to convince YouTube that other peoples’ music was their own. They successfully stole $23 million before they were caught.

  No one knows how common this scam is, and how much money total is being stolen in this way. Presumably this is not an uncommon fraud.