Ubuntu Security Notice 4508-1 - It was discovered that StoreBackup did not properly manage lock files. A local attacker could use this issue to cause a denial of service or escalate privileges and run arbitrary code.
f62b15c1dbb028a8d75a166252979fa71b09b0d3a10e31191e0fcd5eb314597d
==========================================================================
Ubuntu Security Notice USN-4508-1
September 16, 2020
storebackup vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
StoreBackup could be made to stop executing or generate a race condition
if it received a lock file in the default location.
Software Description:
- storebackup: fancy compressing managing checksumming deduplicating
hard-linkin
Details:
It was discovered that StoreBackup did not properly manage lock files. A
local attacker could use this issue to cause a denial of service or
escalate privileges and run arbitrary code. (CVE-2020-7040)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
storebackup 3.2.1-1+deb8u1build0.20.04.1
Ubuntu 18.04 LTS:
storebackup 3.2.1-1+deb8u1build0.18.04.1
Ubuntu 16.04 LTS:
storebackup 3.2.1-1+deb8u1build0.16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4508-1
CVE-2020-7040
Package Information:
https://launchpad.net/ubuntu/+source/storebackup/3.2.1-1+deb8u1build0.20.04.1
https://launchpad.net/ubuntu/+source/storebackup/3.2.1-1+deb8u1build0.18.04.1
https://launchpad.net/ubuntu/+source/storebackup/3.2.1-1+deb8u1build0.16.04.1