CVE-2016-3096 Link Following in ansible
Local attackers can exploit symlink vulnerabilities in Ansible's LXC module to write arbitrary files or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-3096?
CVE-2016-3096 is a high-severity path traversal vulnerability in Fedoraproject Fedora, published on 3 Jun 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.
Weakness: CWE-59
Which versions are affected by CVE-2016-3096?
5 open source packages ship an affected version, including ansible. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 1.9.6.1 |
ansible PyPI | All versions | 1.9.6.1 |
ansible PyPI | All versions | 2.0.2.0 |
ansible PyPI | From 2.0.0.0 | 2.0.2.0 |
ansible PyPI | From 2.0.0.0 | 2.0.2.0 |
Products include Fedoraproject Fedora, Redhat Ansible.
How do I fix CVE-2016-3096?
Upgrade ansible to a fixed version for your release line: 1.9.6.1 or 2.0.2.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-3096 being exploited?
There is no known exploitation of CVE-2016-3096 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2016-3096, GHSA-rh6x-qvg7-rrmj, MGASA-2016-0163, PYSEC-2016-1, UBUNTU-CVE-2016-3096.