SB2017020922 - Multiple vulnerabilities in firejail.wordpress.com firejail

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017020922

SB2017020922 - Multiple vulnerabilities in firejail.wordpress.com firejail

Published: February 9, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017020922
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Improper Privilege Management (CVE-ID: CVE-2017-5207)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local authenticated user to execute arbitrary code.

Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.


2) Missing Authorization (CVE-ID: CVE-2017-5180)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local authenticated user to execute arbitrary code.

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option.


Remediation

Install update from vendor's website.

References