USN-4-1: Standard C library script vulnerabilities
Recently, Trustix Secure Linux discovered some vulnerabilities in the libc6 package. The utilities "catchsegv" and "glibcbug" created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-4-1?
The severity of USN-4-1 is high due to the potential for arbitrary file creation or overwriting via a symlink attack.
How do I fix USN-4-1?
To fix USN-4-1, update the libc6 package to the latest version available in your Ubuntu repository.
What are the affected systems for USN-4-1?
USN-4-1 affects Ubuntu Linux version 4.10 that uses the vulnerable libc6 package.
What kind of attack does USN-4-1 describe?
USN-4-1 describes a symlink attack resulting from insecure temporary file handling.
Are there any mitigating factors for USN-4-1?
Mitigation for USN-4-1 primarily involves keeping the system and packages up to date to prevent exploitation.