PT-2017-7750 · Linux+2 · Linux Containers+2

Publicado 2016-08-22 · Atualizado 2017-11-13 · CVE-2016-10124

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux Containers (LXC) versions prior to 2016-02-22

Description An issue in Linux Containers allows a non-privileged session to escape to the parent session. This is achieved by using the TIOCSTI ioctl to push characters into the terminal's input buffer, enabling an attacker to escape the container.

Recommendations For versions prior to 2016-02-22, update to a version released after 2016-02-22 to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2016-1870

CVE-2016-10124

USN-3375-1

Produtos afetados

Alt Linux

Linux Containers

Ubuntu

Referências · 14

• https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6 · Correção
• https://security-tracker.debian.org/tracker/CVE-2016-10124 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-10124 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/09/03/5 · Nota
• http://securityfocus.com/bid/95404 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10124 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/12/15/5 · Nota
• https://cve.org/CVERecord?id=CVE-2016-10124 · Nota de Segurança
• https://osv.dev/vulnerability/USN-3375-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10124 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201711-09 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-10124 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3375-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10124 · Aviso do Fabricante