Security 0-day attacks on Ubuntu & Fedora

eva2000 · Dec 18, 2016

Ouch 0-days hitting Fedora and Ubuntu open desktops to a world of hurt | Ars Technica

If you run a mainstream distribution of Linux on a desktop computer, there's a good chance security researcher Chris Evans can hijack it when you do nothing more than open or even browse a specially crafted music file. And in the event you're running Chrome on the just-released Fedora 25, his code-execution attack works as a classic drive-by.

The zero-day exploits, which Evans published on Tuesday, are the latest to challenge the popular conceit that Linux, at least in its desktop form, is more immune to the types of attacks that have felled Windows computers for more than a decade and have increasingly snared Macs in recent years.

While Evans' attacks won't work on most Linux servers, they will reliably compromise most desktop versions of Linux, which employees at Google, Facebook, and other security conscious companies often use in an attempt to avoid the pitfalls of Windows and Mac OS X. Three weeks ago, Evans released a separate Linux zero-day that had similarly dire consequences.
Click to expand...

@Jimmy @Colin

Jimmy · Dec 18, 2016

These things happen. I don't download files as it is. Fedora just released a kernel update last night. Maybe it addresses this issue?

pamamolf · Dec 18, 2016

Let's hope that they will patch it soon

Jimmy · Dec 18, 2016

Testing.... Fix should be released soon.

https://bodhi.fedoraproject.org/updates/FEDORA-2016-fbf9f8b204

Bug 1405423 – CVE-2016-9957 CVE-2016-9958 CVE-2016-9959 CVE-2016-9960 CVE-2016-9961 game-music-emu: Multiple issues due to incorrect emulation of the SPC700 audio co-processor of SNES

Colin · Dec 19, 2016

eep. Hard to protect against, even with paranoia on 9.

Given the relative cross-distro there via fedora and ubuntu, I'd imagine none are safe. My argument for going to the path lesser travelled falls down (suse). He types from his windows 10 desktop... lol.

I'm kind of tempted for 'special' sites, to spin up a remote cloud desktop, then destroy. It's a step up from keeping one browser solely for that task. Perhaps the future is a CoreOS console, boot up the machine type you want to use today, synch from cloud store and go.

Log in / Register

Forums

Want more timely Centmin Mod News Updates?

Security 0-day attacks on Ubuntu & Fedora

eva2000 Administrator Staff Member

Jimmy Well-Known Member

pamamolf Well-Known Member

Jimmy Well-Known Member

Colin Premium Member Premium Member

.

Log in / Register

Useful Searches

Want more timely Centmin Mod News Updates?

Security 0-day attacks on Ubuntu & Fedora

eva2000 Administrator Staff Member

Jimmy Well-Known Member

pamamolf Well-Known Member

Jimmy Well-Known Member

Colin Premium Member Premium Member

.