Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 528
Alerts This Week
Warning Icon 1 528

Ubuntu 14.04 ESM USN-5292-3 Moderate: Snapd Access Control Issues

ubuntu
Calendar Grey February 17, 2022
Dist Ubuntu Esm H88
Multiple vulnerabilities in snapd addressed in Ubuntu 14.04 and 16.04 ESM, encompassing access restrictions and privilege escalation threats.
Several security issues were fixed in snapd.

Summary

Several security issues were fixed in snapd.

Software Description:

- snapd: Daemon and tooling that enable snap packages

Details:

USN-5292-1 fixed several vulnerabilities in snapd. This update provides the

corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

James Troup discovered that snap did not properly manage the permissions for

the snap directories. A local attacker could possibly use this issue to expose

sensitive information. (CVE-2021-3155)

Ian Johnson discovered that snapd did not properly validate content interfaces

and layout paths. A local attacker could possibly use this issue to inject

arbitrary AppArmor policy rules, resulting in a bypass of intended access

restrictions. (CVE-2021-4120)

The Qualys Research Team discovered that snapd did not properly validate the

location of the snap-confine binary. A local attacker could possibly use this

issue to execute other arbitrary binaries and es...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory moderate privilege escalation access control Ubuntu 16.04 Ubuntu 14.04 snapd

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  snap-confine                    2.54.3+16.04~esm2
  snapd                           2.54.3+16.04~esm2

Ubuntu 14.04 ESM:
  snap-confine                    2.54.3+14.04~esm1
  snapd                           2.54.3+14.04~esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5292-3

https://ubuntu.com/security/notices/USN-5292-1

CVE-2021-3155, CVE-2021-4120, CVE-2021-44730, CVE-2021-44731

February 18, 2022

Topics%20covered

Topics Covered

security advisory moderate privilege escalation access control Ubuntu 16.04 Ubuntu 14.04 snapd

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.