Remote code exec found in Alpine Linux

By

Update and rebuild or risk pwnage.

Users of Alpine Linux are advised to update their installations - especially those used for Docker production environments - after a researcher found a remotely exploitable bug in the distribution's package manager.

Remote code exec found in Alpine Linux

Alpine Linux is popular with Docker users due to its small size and package repository.

Crowdfunded bug bounty program BountyGraph co-founder Max Justicz managed to exploit Alpine .apk package files to create arbitrary files which could be turned into code execution.

The bug discovered by Justicz allows a malicious package mirror, or an attacker with a network man-in-the-middle position, to run arbitrary code on users' machines.

"This is especially bad because packages aren’t served over TLS [transport layer security] when using the default repositories," Justicz said.

Alpine Linux has fixed the remote code execution bug.

Justicz advised users to rebuild their images and to donate what they could to the OS developers.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Log In

  |  Forgot your password?