Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 569
Alerts This Week
Warning Icon 1 569

Ubuntu 20.10, 20.04 LTS: USN-4707-1 Critical TCMU Input Threat

ubuntu
Calendar Grey January 28, 2021
Dist Ubuntu Esm H88
Critical TCMU input issue could crash Ubuntu 20.10 and 20.04 LTS systems with crafted input, requiring urgent update.
tcmu could be made to crash if it received specially crafted input.

Summary

tcmu could be made to crash if it received specially crafted

input.

Software Description:

- tcmu: TCM-Userspace backend

Details:

It was discovered that TCMU lacked a check for transport-layer restrictions,

allowing remote attackers to read or write files via directory traversal in

an XCOPY request.

Topics%20covered

Topics Covered

security advisory critical directory traversal Ubuntu remote threat system update ubuntu input manipulation TCMU tcmu input attack transport-layer

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  libtcmu2                        1.5.2-5ubuntu0.20.10.1
  tcmu-runner                     1.5.2-5ubuntu0.20.10.1

Ubuntu 20.04 LTS:
  libtcmu2                        1.5.2-5ubuntu0.20.04.1
  tcmu-runner                     1.5.2-5ubuntu0.20.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4707-1

CVE-2021-3139

Severity
critical
Lowest
Low
Medium
High
Critical

January 28, 2021

Topics%20covered

Topics Covered

security advisory critical directory traversal Ubuntu remote threat system update ubuntu input manipulation TCMU tcmu input attack transport-layer

Package Information

https://launchpad.net/ubuntu/+source/tcmu/1.5.2-5ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/tcmu/1.5.2-5ubuntu0.20.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.