Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : libmodule-signature-perl vulnerabilities (USN-2607-1)

Ubuntu Security Notice (C) 2015-2016 Canonical, Inc. / NASL script (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing a security-related patch.

Description :

John Lightsey discovered that Module::Signature incorrectly handled
PGP signature boundaries. A remote attacker could use this issue to
trick Module::Signature into parsing the unsigned portion of the
SIGNATURE file as the signed portion. (CVE-2015-3406)

John Lightsey discovered that Module::Signature incorrectly handled
files that were not listed in the SIGNATURE file. A remote attacker
could use this flaw to execute arbitrary code when tests were run.
(CVE-2015-3407)

John Lightsey discovered that Module::Signature incorrectly handled
embedded shell commands in the SIGNATURE file. A remote attacker could
use this issue to execute arbitrary code during signature
verification. (CVE-2015-3408)

John Lightsey discovered that Module::Signature incorrectly handled
module loading. A remote attacker could use this issue to execute
arbitrary code during signature verification. (CVE-2015-3409).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected libmodule-signature-perl package.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.7
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 83414 ()

Bugtraq ID: 73935
73937

CVE ID: CVE-2015-3406
CVE-2015-3407
CVE-2015-3408
CVE-2015-3409

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now