UBUNTU-CVE-2017-7480: Critical severity ubuntu/rkhunter vulnerability

Q: What conditions are required for exploitation?

An attacker must be able to interfere with the insecure channel used during a rkhunter mirror update. No authentication or user interaction is required according to the supplied severity vector.

Q: Which installations should be prioritized for remediation?

Systems running rkhunter versions earlier than 1.4.4 should be prioritized, particularly where mirror updates are performed over networks an attacker could intercept or manipulate. Successful exploitation can lead to remote code execution with high confidentiality, integrity, and availability impact.

Published Jul 21, 2017

Updated

rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.

Affected Software

2 affected componentsFixes available

ubuntu/rkhunter<1.4.0-3ubuntu0.1~esm1

1.4.0-3ubuntu0.1~esm1

ubuntu/rkhunter<1.4.2-5ubuntu0.1~esm1

1.4.2-5ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/rkhunter to a version that resolves this vulnerability.
Fixed in 1.4.0-3ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/rkhunter to a version that resolves this vulnerability.
Fixed in 1.4.2-5ubuntu0.1~esm1
Upgrade
Upgrade rkhunter to a version that resolves this vulnerability.
Fixed in 1.4.4

Event History

Jul 21, 2017

CVE Published

via OSV·10:29 PM

Data Sourced

via OSV·10:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to interfere with the insecure channel used during a rkhunter mirror update. No authentication or user interaction is required according to the supplied severity vector.

Which installations should be prioritized for remediation?