1

Ok, so I understand how Ubuntu does their package releases and what-not but I need to install security updates reliably without searching the vast Internet downloading and compiling. Does anyone know of a good PPA I can add to my sources.list to install the latest packages that fix a known vulnerability? Debian has the sid repository...will that work with Trusty 14.04? Or is there something comparable in Ubuntu?

Appreciate the help.

Improve this question
5
  • Trusty gets security updates "reliably without searching the vast Internet...", and without any PPAs.
    – mikewhatever
    Dec 15, 2015 at 18:28
  • Then how come when I do an apt-get update and apt-get dist-upgrade I don't get the latest version of OpenSSL or OpenSSH or Apache?
    – YouDontNeedMyName
    Dec 15, 2015 at 18:44
  • 1
    That's the way Ubuntu works, which has been inherited from Debian. Stable releases never have the latest packages, instead, older packages are maintained with security updates and critical fixes. wiki.ubuntu.com/StableReleaseUpdates
    – mikewhatever
    Dec 15, 2015 at 18:54
  • So I understand the emphasis on reliability over releasing latest and greatest but from a security standpoint it just doesn't make sense to me, so how do I explain to my security auditor, "I know it's not the latest version but it's not vulnerable because a third party supposedly fixed the vulnerability in a maintenance release that is dated prior to when the vulnerability was originally reported." ?
    – YouDontNeedMyName
    Dec 15, 2015 at 20:12
  • That's about right, as far as the explanation goes. If it doesn't make sense to you or security auditors, I am sorry, but that is the way most Linux (Debian, *buntus, RHEL, CentOS) distros have been working for years. I rather doubt it's going to change soon, so, may be Ubuntu is just not for you, and you should look at something like Arch Linux, or other OSs.
    – mikewhatever
    Dec 15, 2015 at 23:09

2 Answers 2

Reset to default
2

...so how do I explain to my security auditor, "I know it's not the latest version but it's not vulnerable because a third party supposedly fixed the vulnerability in a maintenance release that is dated prior to when the vulnerability was originally reported." ?

That's about right, as far as the explanation goes. If it doesn't make sense to you or security auditors, I am sorry, but that is the way most Linux distros (Debian, *buntus, RHEL, CentOS) have been working for years. I rather doubt it's going to change soon, so, may be Ubuntu is just not for you, and you should look at something like Arch Linux, Debian unstable, or other OSs.

PS: You can check what's been fixed in a package in Ubuntu with the following:

apt-get changelog pkgname

For example, apt-get changelog openssh-server looks like this:

openssh (1:6.6p1-2ubuntu2.3) trusty-security; urgency=medium

  • SECURITY REGRESSION: random auth failures because of uninitialized struct field (LP: #1485719)

    • debian/patches/CVE-2015-5600-2.patch:

    -- Marc Deslauriers Mon, 17 Aug 2015 21:52:52 -0 400

openssh (1:6.6p1-2ubuntu2.2) trusty-security; urgency=medium

  • SECURITY UPDATE: possible user impersonation via PAM support
    • debian/patches/pam-security-1.patch: don't resend username to PAM in monitor.c, monitor_wrap.c.
    • CVE number pending * SECURITY UPDATE: use-after-free in PAM support
    • debian/patches/pam-security-2.patch: fix use after free in monitor.c.
    • CVE number pending

...

Improve this answer
2
  • That was helpful, thank you but when I run the command to look at the change log there are a couple of CVE's missing. The latest in the changelog is CVE-2015-5600-2. However, when comparing to www.cvedetails.com there is CVE-2015-6565 published in Aug 23 2015 and CVE-2015-6564 published Aug 25 2015 still missing. So my understanding is the current release of ssh-server available to me from the official repository is still vulnerable as well as *-client. There were published almost 4 months ago and I know understandably that these things take time for someone to code but I need to patch this.
    – YouDontNeedMyName
    Dec 15, 2015 at 23:41
  • @YouDontNeedMyName no, CVE-2015-6565 doesn't even affect us, and CVE-2015-6564 has been patched.
    – muru
    Dec 16, 2015 at 1:48
1

Your mirror in sources.list may not have updated in a timely manner. Most vulnerabilities get patched to the main server then the mirrors need to update. Every mirror updates at its own speed. You can subscribe to the security RSS feed at http://www.ubuntu.com/usn/rss.xml to view the latest updates and either switch to the primary site for downloads or wait for your selected mirror to update.

Improve this answer
1
  • Thanks for the suggestion but I do not believe that is the case since the new versions of apache and ssl have been out for many "moons" now and I was only able to update my oppenssl to 1.0.2 using PPA (ppa.launchpad.net/ondrej/php5-5.6/ubuntu) Furthermore, when I browse ubuntu's packages URL (packages.ubuntu.com) I only see 1.0.1 for trusty: trusty (14.04LTS) (utils): Secure Sockets Layer toolkit - cryptographic utility 1.0.1f-1ubuntu2.16 [security]: amd64 i386
    – YouDontNeedMyName
    Dec 15, 2015 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .