Ubuntu 16.10: USN-3246-1 Critical Eject Admin Access Threat

ubuntu

March 27, 2017

Eject could be made to run programs as an administrator.

Summary

Eject could be made to run programs as an administrator.

Software Description:

- eject: ejects CDs and operates CD-Changers under Linux

Details:

Ilja Van Sprundel discovered that dmcrypt-get-device incorrectly checked setuid

and setgid return values. A local attacker could use this issue to execute code

as an administrator.

Topics Covered

security advisory software update local attack ubuntu risk admin access eject

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  eject                           2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1

Ubuntu 16.04 LTS:
  eject                           2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  eject                           2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  eject                           2.1.5+deb1+cvs20081104-9ubuntu0.1

In general, a standard system update will make all the necessary changes.