Remote Code Execution Vulnerability in Docker (CVE-2014-6407)
Summary
CVE-2014-6407: Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation. Affects docker.io versions < 1.3.2~dfsg1-1. Fixed in 1.3.2~dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that automates the deployment of applications inside software containers. It allows developers to package applications with all their dependencies into a standardized unit for software development. The vulnerability in question affects Docker versions prior to 1.3.2, where improper handling of symlinks and hard links in image archives can lead to unauthorized file writes and code execution.
Vulnerability Detail
CVE-2014-6407 is a critical vulnerability that allows remote attackers to exploit Docker's image handling mechanisms. By leveraging symlink or hard link attacks during pull or load operations, an attacker can manipulate image archives to write to arbitrary files on the host system. This can lead to unauthorized code execution, potentially compromising the entire system. The vulnerability arises from insufficient validation of file paths in the image archive, making it a significant risk for users running affected versions of Docker.
How To Fix
Minimum fixed version
1.3.2~dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker.ioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of Docker by restricting access to the Docker daemon and avoiding the use of untrusted image archives. Additionally, consider running Docker in a secure environment where file system access is tightly controlled.
Conclusion
CVE-2014-6407 is a significant vulnerability in Docker that poses risks of unauthorized file access and code execution. Users are strongly advised to upgrade to version 1.3.2 or later to mitigate these risks. For those unable to upgrade immediately, implementing workarounds can help reduce exposure until a proper fix is applied.
See every vulnerability recorded for docker.io →
FAQ
CVE-2014-6407 is a vulnerability in Docker that allows remote attackers to write to arbitrary files and execute code through symlink or hard link attacks.
Docker versions prior to 1.3.2 are affected by this vulnerability.
You can check your Docker version by running 'docker --version' in your terminal. If it is below 1.3.2, it is vulnerable.
If an immediate upgrade is not possible, restrict access to the Docker daemon and avoid using untrusted image archives as a temporary workaround.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application for vulnerabilities at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for docker.io.
