HackDig : Dig high-quality web security articles for hackers

CVE-2016-4484: - Cryptsetup Initrd root Shell

2016-11-15 08:30
Hello All,


Affected package
----------------
Cryptsetup <= 2:1


CVE-ID
------
CVE-2016-4484


Description
-----------
A vulnerability in Cryptsetup, concretely in the scripts that unlock the
system partition when the partition is ciphered using LUKS (Linux
Unified Key Setup).

This vulnerability allows to obtain a root initramfs shell on affected
systems. The vulnerability is very reliable because it doesn't depend on
specific systems or configurations. Attackers can copy, modify or
destroy the hard disc as well as set up the network to exflitrate data.

In cloud environments it is also possible to remotely exploit this
vulnerability without having "physical access."


Full description:
-----------------
http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html


Regards,
Hector Marco & Ismael Ripoll.

Attachment:signature.asc
Description: OpenPGP digital signature



_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


Source: 27/voN/6102/erusolcsidlluf/gro.stsilces

Read:3470 | Comments:0 | Tags:No Tag

“CVE-2016-4484: - Cryptsetup Initrd root Shell”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Tools

Tag Cloud