Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

[Gianfranco Costamagna]

Hi Dirk,


>your recommendation has produced bug #798979 and meanwhile 16 e-mails.
>Why didn't you restrict these obviously not enough tested changes to 
>distributions other than "stable" and "oldstable" or at least to those 
>users who want to work with WiFi? As for Debian no homebanking programs 
>are available which are able to handle with my RSA-chipcard, I am thrown 
>on Windows under VirtualBox. If a new installation of the VM will be 
>necessary I may be confronted with the loss of all my homebanking data, 
>what an awful idea!


Hi Dirk, first, you can always downgrade virtualbox, and you have plenty of 
google
links teaching you how to cope with that.

I can't reproduce the problem, and I'm trying together with upstream my best to 
fix it.

For sure your bug report started with

"virtualbox: DSA-3359-1 causes VBoxClient to send error message "The VirtualBox 
kernel
service is not running" and to break off."
and no bug content, so you didn't gave me enough stuff to work on.


anyway, I have some questions for you, while I'm trying hardly to reproduce the 
problem

(I did install and upgrade on a clean jessie without *any* issue in restarting 
VMs)

I had similar reports in ubuntu, and they were caused by people running the 
virtualbox install from Oracle website
(not the deb file, because we conflict with them) and then not completely 
purging virtualbox prior
to install the Debian package.

So if you really care about your VM you need to give us more information such 
as:

1) did you have a clean system?
2) can you please provide english logs?
3) can you please try to purge virtualbox (maybe from synaptic) and install it 
again?

in the last case I would like to see the full install log, and for sure all the 
log files
mentioned in a possible failure.

cheers,

Gianfranco

Re: [SECURITY] [DSA 3359-1] virtualbox security update

[Dirk Olsen]

Am 13.09.2015 um 21:47 schrieb Moritz Muehlenhoff:


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

- -
Debian Security Advisory DSA-3359-1   secur...@debian.org
https://www.debian.org/security/   Moritz Muehlenhoff
September 13, 2015https://www.debian.org/security/faq
- -

Package: virtualbox
CVE ID : CVE-2015-2594

This update fixes an unspecified security issue in VirtualBox related to
guests using bridged networking via WiFi. Oracle no longer provides
information on specific security vulnerabilities in VirtualBox. To still
support users of the already released Debian releases we've decided to
update these to the respective 4.1.40 and 4.3.30 bugfix releases.

For the oldstable distribution (wheezy), this problem has been fixed
in version 4.1.40-dfsg-1+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 4.3.30-dfsg-1+deb8u1.

For the testing distribution (stretch), this problem has been fixed
in version 4.3.30-dfsg-1.

For the unstable distribution (sid), this problem has been fixed in
version 4.3.30-dfsg-1.

We recommend that you upgrade your virtualbox packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-annou...@lists.debian.org
-BEGIN PGP SIGNATURE-
[...]

-END PGP SIGNATURE-


Hi,

your recommendation has produced bug #798979 and meanwhile 16 e-mails.
Why didn't you restrict these obviously not enough tested changes to 
distributions other than "stable" and "oldstable" or at least to those 
users who want to work with WiFi? As for Debian no homebanking programs 
are available which are able to handle with my RSA-chipcard, I am thrown 
on Windows under VirtualBox. If a new installation of the VM will be 
necessary I may be confronted with the loss of all my homebanking data, 
what an awful idea!


Dirk Olsen

Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

[Ritesh Raj Sarraf]

Adding the other bug, similar to it, against Unstable.


As mentioned earlier, it does look like we need to add a tighter
dependency in between the dkms/source package and the main virtualbox
package.


I just made the changes, built, and verified locally. And it seems to
be in line with my root cause. Ofcourse, before I'd like we push it to
Unstable first (and close 798527), and then tackle the other stable
releases. And any additional testing is going to help now.


Please see console log below. With the tighter dependency now,
virtualbox does not get picked until its {Pre}Dependency, i.e.
virtualbox-dkms is properly installed.

I have pushed the changes to the git repo, for the master branch.

@Gianfranco: I'm still on the sloppy internet network, so if you have
the bandwidth, please feel free to prepare the new upload.


rrs@chutzpah:/var/tmp/vbox$ apt-cache policy virtualbox virtualbox-dkms
virtualbox:
  Installed: 5.0.4-dfsg-2
  Candidate: 5.0.4-dfsg-2
  Version table:
 5.0.4-dfsg-3 0
500 file:/var/tmp/vbox/  Packages
 *** 5.0.4-dfsg-2 0
990 http://ftp.debian.org/debian/ testing/contrib amd64
Packages
500 http://ftp.debian.org/debian/ unstable/contrib amd64
Packages
100 /var/lib/dpkg/status
virtualbox-dkms:
  Installed: 5.0.4-dfsg-2
  Candidate: 5.0.4-dfsg-2
  Version table:
 5.0.4-dfsg-3 0
500 file:/var/tmp/vbox/  Packages
 *** 5.0.4-dfsg-2 0
990 http://ftp.debian.org/debian/ testing/contrib amd64
Packages
500 http://ftp.debian.org/debian/ unstable/contrib amd64
Packages
100 /var/lib/dpkg/status
22:56 ♒♒♒   ☺

rrs@chutzpah:/var/tmp/vbox$ sudo aptitude install virtualbox=5.0.4-dfsg
-3 virtualbox-dkms=5.0.4-dfsg-3 virtualbox-qt=5.0.4-dfsg-3
The following packages will be upgraded: 
  virtualbox virtualbox-dkms virtualbox-qt 
3 packages upgraded, 0 newly installed, 0 to remove and 6 not upgraded.
Need to get 0 B/21.3 MB of archives. After unpacking 12.3 kB will be
freed.
Do you want to continue? [Y/n/?] 
WARNING: untrusted versions of the following packages will be
installed!

Untrusted packages could compromise your system's security.
You should only proceed with the installation if you are certain that
this is what you want to do.

  virtualbox virtualbox-dkms virtualbox-qt 

Do you want to ignore this warning and proceed anyway?
To continue, enter "Yes"; to abort, enter "No": Yes
Reading changelogs... Doneelogs... 33%   
(Reading database ... 332296 files and directories currently
installed.)
Preparing to unpack .../virtualbox-dkms_5.0.4-dfsg-3_all.deb ...

 Uninstall Beginning 
Module:  virtualbox
Version: 5.0.4
Kernel:  4.1.7+ (x86_64)
-

Status: Before uninstall, this module version was ACTIVE on this
kernel.

vboxdrv.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.


vboxnetadp.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.


vboxnetflt.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.


vboxpci.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.

depmod...

DKMS: uninstall completed.

--
Deleting module version: 5.0.4
completely from the DKMS tree.
--
Done.
Unpacking virtualbox-dkms (5.0.4-dfsg-3) over (5.0.4-dfsg-2) ...
Preparing to unpack .../virtualbox-qt_5.0.4-dfsg-3_amd64.deb ...
Unpacking virtualbox-qt (5.0.4-dfsg-3) over (5.0.4-dfsg-2) ...
Processing triggers for hicolor-icon-theme (0.13-1) ...
Processing triggers for shared-mime-info (1.3-1) ...
Unknown media type in type 'all/all'
Unknown media type in type 'all/allfiles'
Processing triggers for mime-support (3.59) ...
Processing triggers for gnome-menus (3.13.3-6) ...
Processing triggers for desktop-file-utils (0.22-1) ...
Processing triggers for menu (2.1.47) ...
Processing triggers for man-db (2.7.3-1) ...
Setting up virtualbox-dkms (5.0.4-dfsg-3) ...
Loading new virtualbox-5.0.4 DKMS files...
Building only for 4.1.7+
Building initial module for 4.1.7+
Done.

vboxdrv:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/4.1.7+/updates/dkms/

vboxnetadp.ko:
Running module version sanity check.
 - Original module
  

Re: [SECURITY] [DSA 3359-1] virtualbox security update

[Moritz Mühlenhoff]

Georgi Naplatanov  schrieb:
>
> Dear maintainer(s),
> virtualbox-guest-additions-iso package version is 4.3.18. Are you going
> to update the package to version 4.3.30?

The security team support doesn't support non-free. The maintainer can update
it in a point update if needed.

Cheers,
Moritz

Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

[Gianfranco Costamagna]

BTW I'm mostly sure as we specified in a previous email, this problem is not 
related to the security
DSA, but with a race condition in an upgrade path handled by apt.
(probably always here, but with systemd it might be occurring more frequently).

(it might have happened with a one-line patch, or even with a no change rebuild)


A solution might be to do a
"systemctl stop virtualbox" and check that no "VBoxSVC" is running.


(and sorry for the bad experience you had)


cheers,

Gianfranco

Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

[Dirk Olsen]

Am 18.09.2015 um 12:07 schrieb Gianfranco Costamagna:


[...]

Hi Dirk, first, you can always downgrade virtualbox, and you have plenty of 
google
links teaching you how to cope with that.

[...]


Hi Gianfranco,

before taking further action I would like to know whether the Debian 
Security Team or the command "apt-get" use Google utilities when working 
internal.


Sincerely, Dirk Olsen