Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 481
Alerts This Week
Warning Icon 1 481

Ubuntu 12.04 LTS USN-2105-1 Critical: MAAS Privilege Escalation

ubuntu
Calendar Grey February 13, 2014
Scroller Ubuntu
The recent Ubuntu Security Announcement USN-2105-1 highlights several vulnerabilities in MAAS that could lead to privilege escalation and also pose cross-site scripting threats.
The cluster could be made to run programs as an administrator.

Summary

The cluster could be made to run programs as an administrator.

Software Description:

- maas: Ubuntu MAAS Server

Details:

James Troup discovered that MAAS stored RabbitMQ authentication

credentials in a world-readable file. A local authenticated user

could read this password and potentially gain privileges of other

user accounts. This update restricts the file permissions to prevent

unintended access. (CVE-2013-1070)

Chris Glass discovered that the MAAS API was vulnerable to cross-site

scripting vulnerabilities. With cross-site scripting vulnerabilities,

if a user were tricked into viewing a specially crafted page, a remote

attacker could exploit this to modify the contents, or steal confidential

data, within the same domain. (CVE-2013-1069)

Topics%20covered

Topics Covered

security advisory critical privilege escalation cross-site scripting Ubuntu authentication issue MAAS

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  maas-region-controller          1.4+bzr1693+dfsg-0ubuntu2.3
  python-django-maas              1.4+bzr1693+dfsg-0ubuntu2.3

Ubuntu 12.10:
  maas-region-controller          1.2+bzr1373+dfsg-0ubuntu1.2
  python-django-maas              1.2+bzr1373+dfsg-0ubuntu1.2

Ubuntu 12.04 LTS:
  maas-region-controller          1.2+bzr1373+dfsg-0ubuntu1~12.04.5
  python-django-maas              1.2+bzr1373+dfsg-0ubuntu1~12.04.5

After a standard system update you need to restart apache2 to make all
the necessary changes.

References

https://ubuntu.com/security/notices/USN-2105-1

CVE-2013-1069, CVE-2013-1070

Severity
critical
Lowest
Low
Medium
High
Critical

February 13, 2014

Topics%20covered

Topics Covered

security advisory critical privilege escalation cross-site scripting Ubuntu authentication issue MAAS

Package Information

https://launchpad.net/ubuntu/+source/maas/1.4+bzr1693+dfsg-0ubuntu2.3
https://launchpad.net/ubuntu/+source/maas/1.2+bzr1373+dfsg-0ubuntu1.2
https://launchpad.net/ubuntu/+source/maas/1.2+bzr1373+dfsg-0ubuntu1~12.04.5

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.