DebuggingSecurity

Revision 20 as of 2009-04-01 15:27:06

Clear message

Introduction

Marking an Ubuntu bug as a "security bug" (handled by the Ubuntu Security Team) means that the bug affects the security of the system in some way, resulting in a loss or degradation of security measures. Various categories might include:

  • gaining privileges of another user without authorization. For example, a stack overflow in a setuid program allowing a regular user to become the root user. ("Privilege Escalation")
  • accessing information that should be blocked. For example, a user on the system being able to view or modify private files of another user. ("Loss of Privacy")
  • causing data-loss for another user. For example, a flaw in a database application allows a user to corrupt another user's stored information. ("Data Corruption")
  • regression in security features. For example, if the default password hashing algorithm reverts to DES from md5. ("Regression")
  • causing system services to become unavailable. For example, a network daemon can be taken offline remotely. ("Remote Denial of Service")

Marking an Ubuntu security bug as "private" is done in situations where a vulnerability is not yet publicly known. Attempts should be made to contact the upstream project (and other Linux Distributions) privately so that a "coordinated release date" (CRD) can be established. During this time, upstreams and Distributions can work to solve the problem before it goes public, in the hopes of heading off any public exploitation of the flaw. In situations where an upstream and Distributions are not interested in a CRD, the bug can made public so more developers can view the issue. (See "How to Forward" below for more details.)

All security flaws are assigned a CVE identifier. This is used to globally track the flaw so that other Distributions have a common identifier that can be used to discuss the flaw and its solution.

How to File

New security bugs should be created in the Ubuntu bug tracker (Launchpad). If you do not have a Launchpad account and prefer not to create one, you may send your report to security@ubuntu.com.

To report a security vulnerability in an Ubuntu package, follow the regular bug-filing instructions, but take special note of the "Mark as security issue" check box near the bottom of the form:

security-bug.png

By default, all security bugs start their life marked as "private". If the security issue is already public (e.g. in another public bug tracker, discussed on a public mailing list, etc), please follow the "publicly disclose" link in the messages above the filed report:

publicly-disclose.png

In the privacy/security page, you can uncheck the "private" flag, and save the bug:

privacy.png

As with all bugs, please include as much information as possible, including the steps to reproduce the issue starting from a stock installation. In some more complex situations, it can help to carefully explain the difference between the expected results and the unexpected results. (There are many applications in Ubuntu, and most developers do not have familiarity with all of them.)

Subscriptions, Assignments, and Tags

Security bugs automatically have the "ubuntu-security" team subscribed. If the report is against a package in the "universe" repository, it can help with triage to subscribe the "motu-swat" team. This is especially true for private bugs, where there is already a very small audience available to triage bugs.

Please do not assign any team to a bug -- this is only done for MIR Audit requests. Subscriptions are sufficent to get the attention of needed teams.

Tags are used to help track specific classes of bugs or wishlist items. Please use the following tags to identify certain situations:

  • "hardened-ftbfs" When a package does not build due to the hardened CompilerFlags, and a solution is not immediately known, please add this tag.

  • "format-security" When a package's build log shows *printf format security warnings ("warning: format is not string literal"), and needs attention to fix possible issues.
  • "missing-nx" When a package is built where a program's stack is needlessly marked executable. This tends to happen when there is direct assembly being compiled in and it lacks the stack non-execute bits.

If there are other classes of bugs to track with tags, please discuss them with the SecurityTeam first.

Triage

See Security Team Bug Triage.

Known Bugs

Many security issues are tracked only by their CVE identifier and may not yet have an Ubuntu bug opened for them. The Ubuntu CVE tracker contains the list of open security issues for packages in main/restricted and for universe/multiverse.

For completeness, the list of all CVE identifiers can be reviewed.

Non-Bugs

GPG Keys used by Ubuntu

  • What GPG keys are used to verify Ubuntu distributions?

    • The Ubuntu Archives are signed with keys:

          pub   rsa4096/871920D1991BC93C 2018-09-17 [SC]
          F6ECB3762474EDA9D21B7022871920D1991BC93C
    uid           [ unknown] Ubuntu Archive Automatic Signing Key (2018) <ftpmaster@ubuntu.com>

    pub   4096R/3B4FE6ACC0B21F32 2012-05-11
          Key fingerprint = 790B C727 7767 219C 42C8  6F93 3B4F E6AC C0B2 1F32
    uid                  Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>

    • The Ubuntu ISO Images are signed with keys:

          pub   1024D/FBB75451 2004-12-30
          Key fingerprint = C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451
    uid                  Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>

    pub   4096R/EFE21092 2012-05-11
          Key fingerprint = 8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092
    uid                  Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>

    • The Ubuntu Cloud Images checksums are signed with key:

          pub   4096R/7DB87C81 2009-09-15
          Key fingerprint = D2EB 4462 6FDD C30B 513D  5BB7 1A5D 6C4C 7DB8 7C81
    uid                  UEC Image Automatic Signing Key <cdimage@ubuntu.com>

    • The Ubuntu Cloud Images simplestreams are signed with key:

          pub   rsa4096 2012-10-27 [SC]
          4A3C E3CD 565D 7EB5 C810  E2B9 7FF3 F408 476C F100
    uid                  Ubuntu Cloud Image Builder (Canonical Internal Cloud Image Builder) <ubuntu-cloudbuilder-noreply@canonical.com>
    sub   rsa4096 2012-10-27 [E]

    • The ddebs debug package repositories are signed with key:

          pub   4096R/5FDFF622 2016-03-21 [expires: 2021-03-20]
          Key fingerprint = F2ED C64D C5AE E1F6 B9C6  21F0 C8CA B659 5FDF F622
    uid                  Ubuntu Debug Symbol Archive Automatic Signing Key (2016) <ubuntu-archive@lists.ubuntu.com>
    pub   1024D/428D7C01 2008-09-02
          Key fingerprint = 2512 191F EF87 29D6 E5AF  414D ECDC AD72 428D 7C01
    uid                  Ubuntu Debug Symbol Archive Automatic Signing Key <ubuntu-archive@lists.ubuntu.com>
    sub   2048g/A2C2A7A5 2008-09-02

    • The Kernel PPA packages are signed with key:

          pub   2048R/17C622B0 2008-05-01
          Key fingerprint = 60AA 7B6F 3043 4AE6 8E56  9963 E50C 6A09 17C6 22B0
    uid                  Kernel PPA <kernel-ppa@canonical.com>

    • The Ubuntu Archive Master key, used for Signing key rotations is:

          pub   rsa4096/0x0BFB847F3F272F5B 2007-11-09 [SC]
          Key fingerprint = 153F 1C9E F139 5FBF 0035  2E8D 0BFB 847F 3F27 2F5B
    uid                  Ubuntu Archive Master Signing Key <ftpmaster@ubuntu.com>

    • The Ubuntu Extended Security Maintenance archive is signed with:

          pub   rsa4096/67C7A026 2017-04-21 [SC]
          Key fingerprint = 74AE 092F 7629 ACDF 4FB1  7310 B4C2 AF7A 67C7 A026
    uid                    Ubuntu Extended Security Maintenance Automatic Signing Key <esm@canonical.com>
    uid                    Ubuntu ESM <prodstack-cdo@canonical.com>
    sub   rsa4096/80EE65B3 2017-04-21 [E]

    • The Ubuntu FIPS archive is signed with:

          pub   rsa4096/8D13028C 2017-01-09 [SC]
          Key fingerprint = A166 8774 12DA C26E 73CE  BF3F F6C2 8017 8D13 028C
    uid                    Launchpad PPA for ubuntu-advantage

    • The Canonical OEM Vendor Archives are signed with key:

          pub   rsa2048 2008-08-07 [SC]
          236252602787D6BDC2336849F9FDA6BED73CDC22
    uid           [ unknown] Canonical Archive Automatic Signing Key <ftpmaster@canonical.com>

Contact

CategorySecurityTeam CategoryDebugging