Summary
It was discovered that StoreBackup did not properly manage lock files.
A local attacker could use this issue to cause a denial of service or
escalate privileges and run arbitrary code. (CVE-2020-7040)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | storebackup | 3.2.1-1+deb8u1build0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | storebackup | 3.2.1-1+deb8u1build0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | storebackup | 3.2.1-1+deb8u1build0.20.04.1 |
Vulnerabilities 1
-
Unscored —
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks th…
References
-
report
https://ubuntu.com/security/CVE-2020-7040