Upgrade for KDE Neon security issue - Jonathan Riddell's blog

[acheron]

http://jriddell.org/2016/11/14/upgra...ecurity-issue/

Last month we moved the neon archive to a new server so packages got built on our existing server then uploaded to the new server.

Checking the config it seemed I’d made the nasty error of leaving it open to the world rather than requiring an ssh gateway to access the apt repository, so anyone scanning around could have uploaded packages.

There’s no reason to think that happened but the default in security is to be paranoid for any possibility.

The security advisory is out, the archives have been wiped and all packages in User rebuilt so upgrade now to get the new package builds, or for extra security do a reinstall.

The new User Edition ISO is out and I’ll update the website once that gets mirrored enough.

Developer Editions packages are being rebuild now and go directly into the archives so you should start seeing those appear shortly as they are built. Sorry for the hassle folks, you wouldn’t want us to just hide it I’m sure.

[GreyGeek]

That explains the problems I had a few minutes ago while upgrading 347 packages.
I have upgrades set to take place automatically in the background. I used ksysguard to watch the CPU usage as a monitor of progress. When the upgrade was done a reboot icon appeared in the system tray.

I rebooted. I then noticed the update icon was active again. I thought another batch of updates was coming through but ksysguard showed no network activity.

I opened a Konsole and issued sudo apt update and was greeted with the following msg:

:~$ sudo apt update
...
Hit:1 http://repo.steampowered.com/steam precise InRelease
Hit:2 http://us.archive.ubuntu.com/ubuntu xenial InRelease
Get:3 http://us.archive.ubuntu.com/ubuntu xenial-updates InRelease [95.7 kB]
Hit:4 http://archive.canonical.com/ubuntu xenial InRelease Hit:5 http://security.ubuntu.com/ubuntu xenial-security InRelease
Hit:6 http://ppa.launchpad.net/graphics-drivers/ppa/ubuntu xenial InRelease
Hit:7 http://archive.neon.kde.org/user xenial InRelease
Hit:8 http://us.archive.ubuntu.com/ubuntu xenial-backports InRelease
Fetched 95.7 kB in 1s (88.8 kB/s)
E: dpkg was interrupted, you must manually run 'sudo dpkg --configure -a' to correct the problem.

So, it appears that the background process abended. I ran the suggested command:

:~$ sudo dpkg --configure -a
dpkg: dependency problems prevent configuration of libkf5khtml5:amd64:
libkf5khtml5:amd64 depends on libkf5khtml-data (= 5.27.0-0neon+16.04+build16); however:
Package libkf5khtml-data is not installed.

dpkg: error processing package libkf5khtml5:amd64 (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libkf5khtml-bin:
libkf5khtml-bin depends on libkf5khtml5; however:
Package libkf5khtml5:amd64 is not configured yet.

dpkg: error processing package libkf5khtml-bin (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of kio-extras:
kio-extras depends on libkf5khtml5; however:
Package libkf5khtml5:amd64 is not configured yet.

dpkg: error processing package kio-extras (--configure):
dependency problems - leaving unconfigured
Errors were encountered while processing:
libkf5khtml5:amd64
libkf5khtml-bin
kio-extras
jerry@jerry-Aspire-V3-771:~$

I opened Synaptic and searched on "libkf5khtml" and noticed that libkf5khtml-bin was marked for update.
I clicked the apply button. Here are the results:

(Reading database ... 233526 files and directories currently installed.)
Preparing to unpack .../libkf5khtml-data_5.27.0-0neon+16.04+build16_all.deb ...
Unpacking libkf5khtml-data (5.27.0-0neon+16.04+build16) over (5.27.0-0neon+16.04+build12) ...
Setting up libkf5khtml-data (5.27.0-0neon+16.04+build16) ...
Setting up libkf5khtml5:amd64 (5.27.0-0neon+16.04+build16) ...
Setting up libkf5khtml-bin (5.27.0-0neon+16.04+build16) ...
Setting up kio-extras (4:16.08.2-0neon+16.04+build10) ...
Processing triggers for libc-bin (2.23-0ubuntu4) ...

So, eventually, all the packages updated and configured.

I am curious ... before you wiped the repository did you checksum the packages and then compare those sums with the checksums of the newly compiled packages to see IF someone had planted unauthorized packages?

Regardless, I'm choosing to NOT do a re-install, because your new packages replaced the old ones, so if any were compromised they are gone now.

EDIT: I saw the update icon appear in the system tray yet again. So, I opened Synaptic and noticed an addition 80+ packages ready to update. I let Synaptic do it. No problems. The icon went away.

As far as the possibility of malicious artifacts having been planted on my system during the last month (?) I will scan for them and remove them. Acheron, exactly when did you do the mis-configure? One can compare btrfs snapshots before your activity with subsequent snapshots and locate miscreants.

EDIT-EDIT:
I finished my system checks and found nothing. While using chkrootkit I did get the false positive on the Ebury rootkit. I never use ssh so I disabled the service.

[acheron]

Regardless, I'm choosing to NOT do a re-install, because your new packages replaced the old ones, so if any were compromised they are gone now.

From Neon Telegram Group

Jan-Frederic 14.11.16 12:37]
there seems to be no definitv answer about that. But @jriddell thinks that the possibility is low. Also the all Packages are rebuilt or are rebulding so if there are packages they would be gone after an (dist) upgrade

Harald Sitter, [14.11.16 13:11]
[In reply to Jan-Frederic]
That is not correct. If I were to exploit a public repo I'd poison one or more existing packages to download a malicious helper and "install" it. Putting the malicious helper into the package itself is neither necessary nor smart from an attackers POV. As such, dist upgrades would not remove malicious artifacts.

Jan-Frederic [14.11.16 13:13]
i didnt said an infected system would be clean after upgrading, i only said the infected package is gone ...

Jan-Frederic [14.11.16 13:13]
so if you really want to be "paranoid" about it you will have to reinstall your OS

Harald Sitter, [14.11.16 13:14]
Also, I would be wary with how lax you take this advisory. To have driven such an exploit one would probably have needed no more than 50 lines of code that scans open ports for the repo software we use and mangle a package. So I absolutely do not agree that it is unlikely to have been exploited, in particular since there is absolutely no data to say that it wasn't.

[vinnywright]

guess this is all the incentive I need to do a fresh Neon user install ,,,,and see how it goes ,,,,,,,,,,,,,,,,dam I had this system so setup and pumped up the way I like .

Jonathan! ,,,,,,

Slow down and be more careful

VINNY

[GreyGeek]

....

Jonathan! ,,,,,,

Slow down and be more careful

VINNY

Acheron is the one who fell on the sword!

[vinnywright]

Acheron is the one who fell on the sword!

yes ,,,but I think @acheron was quoting Mr Riddell,s blog ,,,,yes/no?

VINNY

[GreyGeek]

yes ,,,but I think @acheron was quoting Mr Riddell,s blog ,,,,yes/no?

VINNY

You're right! My mistake!

[MoonRise]

So.... who all is doing a reinstall? I wonder if this would affect Maui?

[acheron]

Acheron is the one who fell on the sword!

Nothing to do with me, fortunately. I was just relaying the news.

yes ,,,but I think @acheron was quoting Mr Riddell,s blog ,,,,yes/no?

Correct.

[GreyGeek]

I'm not. I checked my system and "all is well in the garden".
Besides, I'm retired and I'm lazy.

[acheron]

I'm not. I checked my system and "all is well in the garden".
Besides, I'm retired and I'm lazy.

The laptop I have Neon could do with a wipe and re-install anyway, so this is a good reason to do it.

Can get rid of an old windows partition that only ever got booted less than half a dozen times.

[GreyGeek]

... Can get rid of an old windows partition that only ever got booted less than half a dozen times.

That's why I gave the whole HD to Neon when I installed it a month ago.

[MoonRise]

I'm going to hope Maui was safe and not. I have two machines and one I just recently finished getting all in place and to start over on both would take more time than I have at the moment.

Crossed Fingers!!