Ubuntu 13.04: USN-2013-1 Moderate: Risk of MAAS Access Issues

ubuntu

November 7, 2013

MAAS could be made to run programs as an administrator.

Summary

MAAS could be made to run programs as an administrator.

Software Description:

- maas: Ubuntu MAAS Server

Details:

It was discovered that maas-import-pxe-files incorrectly loaded

configuration information from the current working directory. A local

attacker could execute code as an administrator if maas-import-pxe-files

were run from an attacker-controlled directory. (CVE-2013-1057)

It was discovered that maas-import-pxe-files doesn't cryptographically

verify downloaded content. An attacker could modify images without

detection. (CVE-2013-1058)

Topics Covered

security advisory ubuntu execution risk administrative access local attacker maas

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  maas-cluster-controller         1.3+bzr1461+dfsg-0ubuntu2.3

Ubuntu 12.10:
  maas-cluster-controller         1.2+bzr1373+dfsg-0ubuntu1.1

Ubuntu 12.04 LTS:
  maas-cluster-controller         1.2+bzr1373+dfsg-0ubuntu1~12.04.4

In general, a standard system update will make all the necessary changes.