Lucene search

Veracode Vulnerability DatabaseVERACODE:4127

HistoryMay 03, 2017 - 6:57 a.m.

File Override

2017-05-0306:57:03

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

github.com/docker/docker is vulnerable to file override attacks. It allows local users to set Linux Security Modules (LSM) and docker_t policies. It can be triggered through images that allow volumes to override files in /proc.

CPENameOperatorVersion
github.com/docker/dockereqHEAD
github.com/docker/dockerle1.6.0
dockereq1.6.2__8.el7

Name	Operator	Version
github.com/docker/docker	eq	HEAD
github.com/docker/docker	le	1.6.0
docker	eq	1.6.2__8.el7

References

lists.opensuse.org/opensuse-updates/2015-05/msg00023.html

packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html

seclists.org/fulldisclosure/2015/May/28

github.com/moby/moby/compare/769acfec2928c47a35da5357d854145b1036448d...b6a9dc399be31c531e3753104e10d74760ed75a2

groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ

groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for VERACODE:4127