PT-2013-6047 · Linux Containers+2 · Lxc+2

Usrflo · Published 2013-12-31 · Updated 2014-06-15 · CVE-2013-6441

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LXC versions prior to 1.0.0.beta2

Description The issue concerns the lxc-sshd template in LXC, which uses read-write permissions when mounting /sbin/init. This allows local users to gain privileges by modifying the init file.

Recommendations For versions prior to 1.0.0.beta2, update to version 1.0.0.beta2 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-1782

CVE-2013-6441

DLA-442-1

MGASA-2014-0102

SUSE-RU-2015:0992-1

SUSE-SU-2014_0643-1

USN-2104-1

Affected Products

Alt Linux

Lxc

Suse

References · 16

• 🔥 https://github.com/lxc/lxc/commit/f4d5cc8e1f39d132b61e110674528cac727ae0e2 · Exploit
• https://advisories.mageia.org/MGASA-2014-0102.html · Security Note
• https://osv.dev/vulnerability/CVE-2013-6441 · Vendor Advisory
• http://ubuntu.com/usn/USN-2104-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-6441 · Security Note
• https://ubuntu.com/security/notices/USN-2104-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0102 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6441 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6441 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6441 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6441 · Security Note
• https://bugs.launchpad.net/ubuntu/%2Bsource/lxc/%2Bbug/1261045 · Note
• ❌ https://github.com/dotcloud/lxc/pull/1 · Note, Deleted
• https://bugs.mageia.org/show_bug.cgi?id=12760 · Note