PT-2017-2372 · Debian+1 · Eject+1

Ilja Van Sprundel · Published 2017-03-27 · Updated 2024-01-21 · CVE-2017-6964

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eject versions 2.1.5+deb1+cvs20081104-13.1 and earlier on Debian eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10 eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS eject versions before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS

Description The issue is related to insufficient error handling in the dmcrypt-get-device utility, which is part of the eject package in Debian and Ubuntu. This utility does not check the return value of the setuid or setgid function, potentially allowing an attacker to execute code with root privileges that was intended for an unprivileged user.

Recommendations For eject versions 2.1.5+deb1+cvs20081104-13.1 and earlier on Debian, update to a version later than 2.1.5+deb1+cvs20081104-13.1. For eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10, update to version 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 or later. For eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS, update to version 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 or later. For eject versions before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS, update to version 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 or later. For eject versions before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS, update to version 2.1.5+deb1+cvs20081104-9ubuntu0.1 or later. As a temporary workaround, consider restricting the use of the dmcrypt-get-device utility until a patch is available.

Fix

Unchecked Return Value

Weakness Enumeration

CWE-388

CWE-252

Related Identifiers

BDU:2017-01574

CVE-2017-6964

DLA-876-1

DSA-3823-1

USN-3246-1

Affected Products

Ubuntu

Eject

References · 15

• https://ubuntu.com/usn/usn-3246-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-3823 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6964 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3246-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6964 · Security Note
• https://ubuntu.com/security/CVE-2017-6964 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3823-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3246-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01574 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-6964 · Security Note
• http://debian.org/security/2017/dsa-3823 · Vendor Advisory
• https://t.me/cvenotify/68142 · Telegram Post
• http://securityfocus.com/bid/97154 · Note
• https://launchpad.net/bugs/1673627 · Note