PT-2017-2372 · Debian+1 · Eject+1

Ilja Van Sprundel · Publicado 2017-03-27 · Atualizado 2024-01-21 · CVE-2017-6964

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eject versions 2.1.5+deb1+cvs20081104-13.1 and earlier on Debian eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10 eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS eject versions before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS

Description The issue is related to insufficient error handling in the dmcrypt-get-device utility, which is part of the eject package in Debian and Ubuntu. This utility does not check the return value of the setuid or setgid function, potentially allowing an attacker to execute code with root privileges that was intended for an unprivileged user.

Recommendations For eject versions 2.1.5+deb1+cvs20081104-13.1 and earlier on Debian, update to a version later than 2.1.5+deb1+cvs20081104-13.1. For eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10, update to version 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 or later. For eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS, update to version 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 or later. For eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS, update to version 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 or later. For eject versions before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS, update to version 2.1.5+deb1+cvs20081104-9ubuntu0.1 or later. As a temporary workaround, consider restricting the use of the dmcrypt-get-device utility until a patch is available.

Correção

Unchecked Return Value

Enumeração de Fraquezas

CWE-388

CWE-252

Identificadores relacionados

BDU:2017-01574

CVE-2017-6964

DLA-876-1

DSA-3823-1

USN-3246-1

Produtos afetados

Ubuntu

Eject

Referências · 15

• https://t.me/cvenotify/68142 · Publicação no Telegram
• https://ubuntu.com/usn/usn-3246-1 · Aviso do Fabricante
• https://debian.org/security/2017/dsa-3823 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6964 · Aviso do Fabricante
• http://securityfocus.com/bid/97154 · Nota
• https://osv.dev/vulnerability/USN-3246-1 · Aviso do Fabricante
• https://launchpad.net/bugs/1673627 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6964 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6964 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-6964 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3823-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3246-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-01574 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-6964 · Nota de Segurança
• http://debian.org/security/2017/dsa-3823 · Aviso do Fabricante