DSA-3426-2: ctdb - regression update
Summary
DSA-3426-2: ctdb - regression update. Affects ctdb versions < 1.12+git20120201-5. Fixed in 1.12+git20120201-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ctdb is a package in the Debian ecosystem that provides a clustered database based on Samba's Trivial Database (TDB). It is designed to store temporary data that is shared between multiple nodes in a cluster. This package is vulnerable to several security issues that could lead to privilege escalation, denial of service, information leaks, or data loss.
Vulnerability Detail
The following vulnerabilities have been discovered in ctdb:
-
CVE-2013-7446: A use-after-free vulnerability can be triggered by a specific sequence of operations on local (AF_UNIX) sockets. This can result in a denial of service or privilege escalation.
-
CVE-2015-7799: A user with access to /dev/ppp can cause a denial of service by passing invalid parameters to the PPPIOCSMAXCID ioctl. This vulnerability also affects ISDN PPP device nodes.
-
CVE-2015-7833: The usbvision driver does not properly process certain USB device descriptors, allowing an attacker with physical access to crash the system. This vulnerability was partially fixed in a previous update.
-
CVE-2015-8104: A denial-of-service flaw affects the KVM hypervisor running on AMD processors. A malicious guest can trigger an infinite stream of debug exceptions, causing the host kernel to panic.
-
CVE-2015-8374: Btrfs does not correctly implement truncation of compressed inline extents, leading to potential information leaks and data loss.
-
CVE-2015-8543: A local user with the CAP_NET_RAW capability can cause a denial-of-service by specifying an invalid protocol number for a raw socket.
These vulnerabilities pose a significant risk to the security and stability of systems running ctdb.
How To Fix
Minimum fixed version
1.12+git20120201-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ctdbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the ctdb package to the fixed versions is crucial to address the identified vulnerabilities and ensure the security and stability of systems running ctdb. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ctdb →
FAQ
ctdb is a clustered database package based on Samba's Trivial Database (TDB). It is designed to store temporary data shared between multiple nodes in a cluster.
These vulnerabilities can lead to privilege escalation, denial of service, information leaks, and data loss. They pose a significant risk to the security and stability of systems running ctdb.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities.
No specific workarounds have been provided for these vulnerabilities. It is recommended to upgrade to the fixed versions of the ctdb package.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3426-2 (https://storage.googleapis.com/debian-osv/dsa-osv/DSA-3426-2.json).
Related vulnerabilities
Recent vulnerabilities recorded for ctdb.
