Date: Mon, 14 Nov 2016 20:45:51 +0000 From: Hector Marco <hmarco@...rco.org> To: fulldisclosure@...lists.org, oss security list <oss-security@...ts.openwall.com>, bugtraq@...urityfocus.com Subject: CVE-2016-4484: - Cryptsetup Initrd root Shell Hello All, Affected package ---------------- Cryptsetup <= 2:1 CVE-ID ------ CVE-2016-4484 Description ----------- A vulnerability in Cryptsetup, concretely in the scripts that unlock the system partition when the partition is ciphered using LUKS (Linux Unified Key Setup). This vulnerability allows to obtain a root initramfs shell on affected systems. The vulnerability is very reliable because it doesn't depend on specific systems or configurations. Attackers can copy, modify or destroy the hard disc as well as set up the network to exflitrate data. In cloud environments it is also possible to remotely exploit this vulnerability without having "physical access." Full description: ----------------- http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html Regards, Hector Marco & Ismael Ripoll. Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.