Ubuntu Security Notice 2230-1 - Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use this issue to execute arbitrary code when chkrootkit is run and gain root privileges.
f11e85e6894830aa661e658a635b9b5d789438cf8bc381a15e40e48d556a589f
============================================================================
Ubuntu Security Notice USN-2230-1
June 04, 2014
chkrootkit vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
chkrootkit could be made to run programs as an administrator.
Software Description:
- chkrootkit: rootkit detector
Details:
Thomas Stangner discovered that chkrootkit incorrectly quoted certain
values. A local attacker could use this issue to execute arbitrary code
when chkrootkit is run and gain root privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
chkrootkit 0.49-4.1ubuntu1.14.04.1
Ubuntu 13.10:
chkrootkit 0.49-4.1ubuntu1.13.10.1
Ubuntu 12.04 LTS:
chkrootkit 0.49-4ubuntu1.1
Ubuntu 10.04 LTS:
chkrootkit 0.49-3ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2230-1
CVE-2014-0476
Package Information:
https://launchpad.net/ubuntu/+source/chkrootkit/0.49-4.1ubuntu1.14.04.1
https://launchpad.net/ubuntu/+source/chkrootkit/0.49-4.1ubuntu1.13.10.1
https://launchpad.net/ubuntu/+source/chkrootkit/0.49-4ubuntu1.1
https://launchpad.net/ubuntu/+source/chkrootkit/0.49-3ubuntu0.1