Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 533
Alerts This Week
Warning Icon 1 533

Ubuntu 15.04: 2675-1 Critical: LXC Directory Traversal Exploits

ubuntu
Calendar Grey July 22, 2015
Scroller Ubuntu Esm H88
Mitigations for LXC weaknesses in Ubuntu concerning path traversal and security profile inadequacies. Maintain your security!
Several security issues were fixed in LXC.

Summary

Several security issues were fixed in LXC.

Software Description:

- lxc: Linux Containers userspace tools

Details:

Roman Fiedler discovered that LXC had a directory traversal flaw when creating

lock files. A local attacker could exploit this flaw to create an arbitrary

file as the root user. (CVE-2015-1331)

Roman Fiedler discovered that LXC incorrectly trusted the container's proc

filesystem to set up AppArmor profile changes and SELinux domain transitions. A

local attacker could exploit this flaw to run programs inside the container

that are not confined by AppArmor or SELinux. (CVE-2015-1334)

Topics%20covered

Topics Covered

security advisory critical directory traversal ubuntu lxc

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  liblxc1                         1.1.2-0ubuntu3.1
  lxc                             1.1.2-0ubuntu3.1

Ubuntu 14.10:
  liblxc1                         1.1.0~alpha2-0ubuntu3.3
  lxc                             1.1.0~alpha2-0ubuntu3.3

Ubuntu 14.04 LTS:
  liblxc1                         1.0.7-0ubuntu0.2
  lxc                             1.0.7-0ubuntu0.2

In general, a standard system update will make all the necessary changes. You
will need to restart your previously running LXC containers in Ubuntu 15.04 due
to bug that causes containers to be stopped on during lxc package installation
(https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1476691).

References

https://ubuntu.com/security/notices/USN-2675-1

CVE-2015-1331, CVE-2015-1334

Severity
critical
Lowest
Low
Medium
High
Critical

July 22, 2015

Topics%20covered

Topics Covered

security advisory critical directory traversal ubuntu lxc

Package Information

https://launchpad.net/ubuntu/+source/lxc/1.1.2-0ubuntu3.1
https://launchpad.net/ubuntu/+source/lxc/1.1.0~alpha2-0ubuntu3.3
https://launchpad.net/ubuntu/+source/lxc/1.0.7-0ubuntu0.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.