AppArmor cupsd Sandbox Bypass Due to Use of Hard Links
CVE-2018-6553

8.8HIGH

Key Information:

Vendor

Debian
Status
Cups
Vendor
CVE Published:
11 July 2018

What is CVE-2018-6553?

The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement. This flaw affects versions prior to 2.2.7-1ubuntu2.1 in Ubuntu 18.04 LTS, prior to 2.2.4-7ubuntu3.1 in Ubuntu 17.10, prior to 2.1.3-4ubuntu0.5 in Ubuntu 16.04 LTS, and prior to 1.7.2-0ubuntu1.10 in Ubuntu 14.04 LTS.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

cups Ubuntu 14.04 LTS < 1.7.2-0ubuntu1.10

cups Ubuntu 16.04 LTS < 2.1.3-4ubuntu0.5

cups Ubuntu 17.10 < 2.2.4-7ubuntu3.1

References

https://usn.ubuntu.com/usn/usn-3713-1
vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4243
vendor-advisoryx_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2018/07/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dan Bastone
JSON
.