high7.2Public exploit code
CVE-2015-2285
The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to exe…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ubuntu 15.04 (Development) - 'Upstart' Logrotation Privilege Escalation2015-03-12 · local · linux
Impact
The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ubuntu | Upstart | through 1.13.2-0ubuntu7 |
| Ubuntu | Vivid | Version 15.04 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/130587/Ubuntu-Vivid-Upstart-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2015/Mar/7
- http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/
- https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685
- http://packetstormsecurity.com/files/130587/Ubuntu-Vivid-Upstart-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2015/Mar/7
- http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/
- https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685