[arch-security] [ASA-201412-16] docker: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201412-16
==========================================

Severity: Medium
Date    : 2014-12-15
CVE-ID  : CVE-2014-9356 CVE-2014-9357 CVE-2014-9358
Package : docker
Type    : multiple issues
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE-2014

Summary
=======

The package docker before version 1:1.4.0-1 is vulnerable to multiple
issues including but not limited to privilege escalation and path traversal.

Resolution
==========

Upgrade to 1:1.4.0-1.

# pacman -Syu "docker>=1:1.4.0-1"

The problems have been fixed upstream in version 1.4.0.

Workaround
==========

None.

Description
===========

- CVE-2014-9356 (path traversal)
Path traversal attacks are possible in the processing of absolute
symlinks. In checking symlinks for traversals, only relative links were
considered. This allowed path traversals to exist where they should have
otherwise been prevented. This was exploitable via both archive
extraction and through volume mounts.
This vulnerability allowed malicious images or builds from malicious
Dockerfiles to write files to the host system and escape
containerization, leading to privilege escalation.

- CVE-2014-9357 (privilege escalation)
It has been discovered that the introduction of chroot for archive
extraction in Docker 1.3.2 had introduced a privilege escalation
vulnerability. Malicious images or builds from malicious Dockerfiles
could escalate privileges and execute arbitrary code as a privileged
root user on the Docker host by providing a malicious ‘xz’ binary.

- CVE-2014-9358 (path traversal)
It has been discovered that Docker does not sufficiently validate Image
IDs as provided either via 'docker load' or through registry
communications. This allows for path traversal attacks, causing graph
corruption and manipulation by malicious images, as well as repository
spoofing attacks.

Impact
======

A local attacker is able to create malicious Dockerfiles or image IDs in
order to perform privilege escalation or path traversal.

References
==========

http://www.securityfocus.com/archive/1/534215
https://access.redhat.com/security/cve/CVE-2014-9356
https://access.redhat.com/security/cve/CVE-2014-9357
https://access.redhat.com/security/cve/CVE-2014-9358

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20141215/4474b47c/attachment.bin>