lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Jan 2017 17:58:56 -0800
From: Nathan McCauley <nathan.mccauley@...ker.com>
To: docker-user@...glegroups.com, docker-dev@...glegroups.com, 
 fulldisclosure@...lists.org, oss-security@...ts.openwall.com, 
 vuln@...unia.com, bugtraq@...urityfocus.com
Subject: [FD] Docker 1.12.6 - Security Advisory

Docker Engine version 1.12.6 has been released to address a vulnerability
and is immediately available for all supported platforms. Users are advised
to upgrade existing installations of the Docker Engine and use 1.12.6 for
new installations.

Please send any questions to security@...ker.com.


==============================================================
[CVE-2016-9962] Insecure opening of file-descriptor allows privilege
escalation

==============================================================

RunC allowed additional container processes via `runc exec` to be ptraced
by the pid 1 of the container.  This allows the main processes of the
container, if running as root, to gain access to file-descriptors of these
new processes during the initialization and can lead to container escapes
or modification of runC state before the process is fully placed inside the
container


Credit for this discovery goes to Aleksa Sarai from SUSE and T├Ánis Tiigi
from Docker.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists