Test ID:	1.3.6.1.4.1.25623.1.1.1.2.2016.442
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-442-1)
Summary:	The remote host is missing an update for the Debian 'lxc' package(s) announced via the DLA-442-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'lxc' package(s) announced via the DLA-442-1 advisory. Vulnerability Insight: CVE-2013-6441 The template script lxc-sshd used to mount itself as /sbin/init in the container using a writable bind-mount. This update resolved the above issue by using a read-only bind-mount instead preventing any form of potentially accidental damage. CVE-2015-1335 On container startup, lxc sets up the container's initial file system tree by doing a bunch of mounting, guided by the container's configuration file. The container config is owned by the admin or user on the host, so we do not try to guard against bad entries. However, since the mount target is in the container, it's possible that the container admin could divert the mount with symbolic links. This could bypass proper container startup (i.e. confinement of a root-owned container by the restrictive apparmor policy, by diverting the required write to /proc/self/attr/current), or bypass the (path-based) apparmor policy by diverting, say, /proc to /mnt in the container. This update implements a safe_mount() function that prevents lxc from doing mounts onto symbolic links. Affected Software/OS: 'lxc' package(s) on Debian 6. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-6441 USN-2104-1 http://www.ubuntu.com/usn/USN-2104-1 https://bugs.launchpad.net/ubuntu/%2Bsource/lxc/%2Bbug/1261045 https://github.com/dotcloud/lxc/pull/1 https://github.com/lxc/lxc/commit/f4d5cc8e1f39d132b61e110674528cac727ae0e2 Common Vulnerability Exposure (CVE) ID: CVE-2015-1335 BugTraq ID: 76894 http://www.securityfocus.com/bid/76894 Debian Security Information: DSA-3400 (Google Search) http://www.debian.org/security/2015/dsa-3400 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171358.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170045.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171364.html https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-September/012434.html http://www.openwall.com/lists/oss-security/2015/09/29/4 SuSE Security Announcement: openSUSE-SU-2015:1717 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-10/msg00023.html SuSE Security Announcement: openSUSE-SU-2019:1481 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html http://www.ubuntu.com/usn/USN-2753-1
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.