Stay Secure with the Latest Linux Advisories

security advisorymoderateubuntu

Ubuntu 18.04: USN-4661-1 Moderate: Snapcraft Access Control Flaw

An intended access restriction could be bypassed in snaps built with Snapcraft. =========================================================================Ubuntu Security Notice USN-4661-1 December 03, 2020 snapcraft vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: An intended access restriction could be bypassed in snaps built with Snapcraft Software Description: - snapcraft: easily craft snaps Details: It was discovered that Snapcraft includes the current directory when configuring LD_LIBRARY_PATH for application commands. If a user were tricked into installing a malicious snap or downloading a malicious library, under certain circumstances an attacker could exploit this to affect strict mode snaps that have access to the library and when launched from the directory containing the library. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: snapcraft 2.43.1+18.04.1 Ubuntu 16.04 LTS: snapcraft 2.43.1+16.04.1 For users of the snap package, Snapcraft will automatically refresh itself to Snapcraft 4.4.4 which is unaffected. For users of the deb package, on Ubuntu 16.04 LTS and 18.04 LTS, please perform a standard system update. In either case, once Snapcraft has been updated, you need to rebuild any packages built with the affected Snapcraft. References: https://ubuntu.com/security/notices/USN-4661-1 CVE-2020-27348, https://bugs.launchpad.net/snapcraft/+bug/1901572 Package Information: https://launchpad.net/ubuntu/+source/snapcraft/2.43.1+18.04.1 https://launchpad.net/ubuntu/+source/snapcraft/2.43.1+16.04.1 . A significant vulnerability in Snapcraft allows circumvention of access controls. Ensure your system is updated to mitigate possible threats.. SnapcraftVulnerability, Access Control, Package Update. . LinuxSecurity.com Team

Dec 03, 2020 Ubuntu