The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users     with access to the man account to gain privileges via vectors involving insecure chown use.
    (CVE-2015-1336)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-5334-1 advisory.

    It was discovered that man-db incorrectly handled permission changing operations in its daily cron job,     and was therefore affected by a race condition. An attacker could possibly use this issue to escalate     privileges and execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201707-12 (MAN DB: Privilege escalation)

    The /var/cache/man directory as part of the MAN DB package has group       permissions set to root.
  Impact :

    A local user who does not belong to the root group, but has the ability       to modify the /var/cache/man directory can escalate privileges to the       group root.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
254864	Linux Distros Unpatched Vulnerability : CVE-2015-1336	Nessus	Misc.	high
159026	Ubuntu 16.04 ESM : man-db vulnerability (USN-5334-1)	Nessus	Ubuntu Local Security Checks	high
101343	GLSA-201707-12 : MAN DB: Privilege escalation	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2015-1336

high

Tenable Plugins

high

high

high