Ubuntu.comUB:CVE-2015-8768CVE-2015-8768
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.01 Low
EPSS
Percentile
83.4%
click/install.py in click does not require files in package filesystem
tarballs to start with ./ (dot slash), which allows remote attackers to
install an alternate security policy and gain privileges via a crafted
package, as demonstrated by the test.mmrow app for Ubuntu phone.
Bugs
Notes
| Author | Note |
|---|---|
| jdstrand | app can ship a crafted .click directory that can be used to trick click into installing unintended security policy snappy not affected per me and mvo patch from cjwatson, but not committed to bzr yet updates also needed for vivid stable-phone-overlay and wily stable-phone-overlay. |
References
www.openwall.com/lists/oss-security/2016/01/11/8
insights.ubuntu.com/2015/10/15/update-on-ubuntu-phone-security-issue/
launchpad.net/bugs/cve/CVE-2015-8768
nvd.nist.gov/vuln/detail/CVE-2015-8768
security-tracker.debian.org/tracker/CVE-2015-8768
ubuntu.com/security/notices/USN-2771-1
www.cve.org/CVERecord?id=CVE-2015-8768
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.01 Low
EPSS
Percentile
83.4%