Summary
Matthias Gerstner discovered that there was a race condition in the mkhomedir
tool shipped with the oddjob package. An authenticated attacker could use this
to setup a symlink attack and change permissions on files on the host filesystem.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | oddjob | 0.34.3-2ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | oddjob | 0.34.3-4ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | oddjob | 0.34.4-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 6.3
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 w…
References
-
report
https://ubuntu.com/security/CVE-2020-10737