PT-2018-9573 · Alpine · Alpine Linux+1

Max Justicz · Publicado 2018-12-20 · Atualizado 2020-03-18 · CVE-2018-1000849

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alpine Linux versions prior to 2.6.10 Alpine Linux versions prior to 2.7.6 Alpine Linux versions prior to 2.10.1

Description The issue is related to a bug in apk-tools, Alpine Linux' package manager, which can result in Remote Code Execution. A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file due to bugs in handling long link target name and the way a regular file is extracted.

Recommendations For versions prior to 2.6.10, update to version 2.6.10 or later. For versions prior to 2.7.6, update to version 2.7.6 or later. For versions prior to 2.10.1, update to version 2.10.1 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1000849

Produtos afetados

Alpine Linux

Apk-Tools

Referências · 5

• 🔥 https://justi.cz/security/2018/09/13/alpine-apk-rce.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000849 · Aviso do Fabricante
• https://git.alpinelinux.org/cgit/apk-tools/commit/?id=6484ed9849f03971eb48ee1fdc21a2f128247eb1 · Aviso do Fabricante
• https://alpinelinux.org/posts/Alpine-3.8.1-released.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000849 · Nota de Segurança