It was discovered that libusbmuxd incorrectly handled socket permissions. A remote attacker could use this issue to access services on iOS devices, contrary to expectations. . Package : libusbmuxd Version : 1.0.9-1+deb8u1 CVE ID : CVE-2016-5104 Debian Bug : 825554 It was discovered that libusbmuxd incorrectly handled socket permissions. A remote attacker could use this issue to access services on iOS devices, contrary to expectations. For Debian 8 "Jessie", this problem has been fixed in version 1.0.9-1+deb8u1. We recommend that you upgrade your libusbmuxd packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The file access rights flaw in libusbmuxd version 1.0.9-1+deb8u1 affects Debian LTS installations significantly. libusbmuxd, Debian security, socket permissions, remote attacker. . LinuxSecurity.com Team
The package libusbmuxd before version 1.0.10-2 is vulnerable to access restriction bypass. . Arch Linux Security Advisory ASA-201706-5 ======================================== Severity: Medium Date : 2017-06-05 CVE-ID : CVE-2016-5104 Package : libusbmuxd Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-7 Summary ====== The package libusbmuxd before version 1.0.10-2 is vulnerable to access restriction bypass. Resolution ========= Upgrade to 1.0.10-2. # pacman -Syu "libusbmuxd> =1.0.10-2" The problem has been fixed upstream but no release is available yet. Workaround ========= None. Description ========== The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers on the local network to bypass intended access restrictions and communicate with services on affected devices by connecting to an IPv4 TCP socket. Impact ===== A remote attacker is able to interact with a USB-connected device by connecting to a IPv4 TCP socket. References ========= https://gitlab.archlinux.org/explore/groups https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991d0aed61ce6482614196 http://www.openwall.com/lists/oss-security/2016/05/26/6 https://security.archlinux.org/CVE-2016-5104 . Debian security notice regarding libusbmuxd privilege escalation. Update to version 1.0.10-2 to address moderate severity vulnerabilities.. libusbmuxd Access Bypass, Arch Linux Advisory, Remote Access Threats. . Severity: Medium. LinuxSecurity.com Team
libusbmuxd would allow unintended access to devices over the network.. =========================================================================Ubuntu Security Notice USN-3026-2 July 05, 2016 libusbmuxd vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 Summary: libusbmuxd would allow unintended access to devices over the network. Software Description: - libusbmuxd: USB multiplexor daemon for iPhone and iPod Touch devices Details: It was discovered that libusbmuxd incorrectly handled socket permissions. A remote attacker could use this issue to access services on iOS devices, contrary to expectations. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libusbmuxd4 1.0.10-2ubuntu0.1 Ubuntu 15.10: libusbmuxd2 1.0.9-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3026-2 https://ubuntu.com/security/notices/USN-3026-1 CVE-2016-5104 Package Information: https://launchpad.net/ubuntu/+source/libusbmuxd/1.0.10-2ubuntu0.1 https://launchpad.net/ubuntu/+source/libusbmuxd/1.0.9-1ubuntu0.1 . Security advisory for Ubuntu versions 16.04 and 15.10 regarding libusbmuxd, which may permit unauthorized device access. Please update to a secure version!. libusbmuxd Security, Ubuntu Update, Network Device Flaw. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.