PT-2018-9573 · Alpine · Alpine Linux+1

Max Justicz · Published 2018-12-20 · Updated 2020-03-18 · CVE-2018-1000849

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alpine Linux versions prior to 2.6.10 Alpine Linux versions prior to 2.7.6 Alpine Linux versions prior to 2.10.1

Description The issue is related to a bug in apk-tools, Alpine Linux' package manager, which can result in Remote Code Execution. A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file due to bugs in handling long link target name and the way a regular file is extracted.

Recommendations For versions prior to 2.6.10, update to version 2.6.10 or later. For versions prior to 2.7.6, update to version 2.7.6 or later. For versions prior to 2.10.1, update to version 2.10.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1000849

Affected Products

Alpine Linux

Apk-Tools

References · 5

• 🔥 https://justi.cz/security/2018/09/13/alpine-apk-rce.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000849 · Vendor Advisory
• https://git.alpinelinux.org/cgit/apk-tools/commit/?id=6484ed9849f03971eb48ee1fdc21a2f128247eb1 · Vendor Advisory
• https://alpinelinux.org/posts/Alpine-3.8.1-released.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000849 · Security Note