ubuntu-core-launcher up to 1.0.27.0 setup_snappy_os_mounts access control

Summaryinfo

A vulnerability was found in ubuntu-core-launcher up to 1.0.27.0. It has been classified as critical. The affected element is the function setup_snappy_os_mounts. This manipulation causes access control. The identification of this vulnerability is CVE-2016-1580. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in ubuntu-core-launcher up to 1.0.27.0. It has been declared as very critical. Affected by this vulnerability is the function setup_snappy_os_mounts. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with "ubuntu-core."

The weakness was shared 05/13/2016 (Website). It is possible to read the advisory at bugs.launchpad.net. This vulnerability is known as CVE-2016-1580 since 01/12/2016. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/14/2024). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 90827 (Ubuntu 16.04 LTS : ubuntu-core-launcher vulnerability (USN-2956-1)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Ubuntu Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 196462 (Ubuntu Security Notification for Ubuntu-Core-Launcher Vulnerability (USN-2956-1)).

Upgrading to version 1.0.27.1 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (90827). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• ubuntu-core-launcher

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion