StoreBackup could be made to stop executing or generate a race condition if it received a lock file in the default location.. =========================================================================Ubuntu Security Notice USN-4508-1 September 16, 2020 storebackup vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: StoreBackup could be made to stop executing or generate a race condition if it received a lock file in the default location. Software Description: - storebackup: fancy compressing managing checksumming deduplicating hard-linkin Details: It was discovered that StoreBackup did not properly manage lock files. A local attacker could use this issue to cause a denial of service or escalate privileges and run arbitrary code. (CVE-2020-7040) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: storebackup 3.2.1-1+deb8u1build0.20.04.1 Ubuntu 18.04 LTS: storebackup 3.2.1-1+deb8u1build0.18.04.1 Ubuntu 16.04 LTS: storebackup 3.2.1-1+deb8u1build0.16.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4508-1 CVE-2020-7040 Package Information: https://launchpad.net/ubuntu/+source/storebackup/3.2.1-1+deb8u1build0.20.04.1 https://launchpad.net/ubuntu/+source/storebackup/3.2.1-1+deb8u1build0.18.04.1 https://launchpad.net/ubuntu/+source/storebackup/3.2.1-1+deb8u1build0.16.04.1 . To enhance the security of your Ubuntu system, please ensure you update it to mitigate the critical vulnerability in StoreBackup as described in USN-4508-1, applicable to several LTS versions.. StoreBackup Security, Ubuntu Update, Denial of Service, Exploit Fix. . Severity:Critical. LinuxSecurity.com Team
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. . Package : storebackup Version : 3.2.1-1+deb8u1 CVE ID : CVE-2020-7040 Debian Bug : 949393 storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file. For Debian 8 "Jessie", this problem has been fixed in version 3.2.1-1+deb8u1. We recommend that you upgrade your storebackup packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . BackupSecure Patch Release: Mitigating Symlink Vulnerabilities in Ubuntu LTS to strengthen system integrity and dependability.. Debian Security, storebackup Update, symlink Attacks, Linux Privileges. . Severity: Critical. LinuxSecurity.com Team
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1022-1
Get the latest Linux and open source security news straight to your inbox.