Ubuntu alert USN-3816-2 (systemd)
| From: | Chris Coulson <chris.coulson@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-3816-2] systemd vulnerability | |
| Date: | Mon, 19 Nov 2018 22:41:45 +0000 | |
| Message-ID: | <5b3bf9c1-e3d7-9307-f308-257cb736c01c@canonical.com> |
========================================================================== Ubuntu Security Notice USN-3816-2 November 19, 2018 systemd vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: systemd-tmpfiles could be made to change ownership of arbitrary files. Software Description: - systemd: system and service manager Details: USN-3816-1 fixed several vulnerabilities in systemd. However, the fix for CVE-2018-6954 was not sufficient. This update provides the remaining fixes. We apologize for the inconvenience. Original advisory details: Jann Horn discovered that unit_deserialize incorrectly handled status messages above a certain length. A local attacker could potentially exploit this via NotifyAccess to inject arbitrary state across re-execution and obtain root privileges. (CVE-2018-15686) Jann Horn discovered a race condition in chown_one(). A local attacker could potentially exploit this by setting arbitrary permissions on certain files to obtain root privileges. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-15687) It was discovered that systemd-tmpfiles mishandled symlinks in non-terminal path components. A local attacker could potentially exploit this by gaining ownership of certain files to obtain root privileges. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-6954) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.10: systemd 239-7ubuntu10.4 Ubuntu 18.04 LTS: systemd 237-3ubuntu10.9 Ubuntu 16.04 LTS: systemd 229-4ubuntu21.9 After a standard system update you need to reboot your computer to make all the necessary changes. References: https://usn.ubuntu.com/usn/usn-3816-2 https://usn.ubuntu.com/usn/usn-3816-1 CVE-2018-6954 Package Information: https://launchpad.net/ubuntu/+source/systemd/239-7ubuntu10.4 https://launchpad.net/ubuntu/+source/systemd/237-3ubuntu10.9 https://launchpad.net/ubuntu/+source/systemd/229-4ubuntu21.9 -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...