Summary
It was discovered that nano allowed a possible privilege escalation
through an insecure temporary file. If nano was killed while editing, the
permissions granted to the emergency save file could be used by an
attacker to escalate privileges using a malicious symlink.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | nano | 4.8-1ubuntu1.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | nano | 6.2-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | nano | 7.2-2ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nano | 2.5.3-2ubuntu2+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | nano | 2.9.3-2ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 6.7
Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportuni…
References
-
report
https://ubuntu.com/security/CVE-2024-5742