Remote code exec found in Alpine Linux

Users of Alpine Linux are advised to update their installations - especially those used for Docker production environments - after a researcher found a remotely exploitable bug in the distribution's package manager.

Alpine Linux is popular with Docker users due to its small size and package repository.

Crowdfunded bug bounty program BountyGraph co-founder Max Justicz managed to exploit Alpine .apk package files to create arbitrary files which could be turned into code execution.

The bug discovered by Justicz allows a malicious package mirror, or an attacker with a network man-in-the-middle position, to run arbitrary code on users' machines.

"This is especially bad because packages aren’t served over TLS [transport layer security] when using the default repositories," Justicz said.

Alpine Linux has fixed the remote code execution bug.

Justicz advised users to rebuild their images and to donate what they could to the OS developers.