APT Security – How to Check if a CVE is Fixed in Ubuntu Repositories

In this particular case then the GRAMPS website provides a download link for a Ubuntu .deb package of version 3.2.5.

On this listing page select gramps_3.2.5-1_ubuntu10.deb which should be easily installable by double clicking on the downloaded file.

There is, in fact, a patch for this vulnerability: It's attached to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864466

If any Ubuntu user wants to apply the patch to 16.04 or 18.04, test it, and then report back to the Ubuntu Security Team on their testing, your real contribution to Ubuntu will be welcome.

For folks who don't want to apply patches themselves, nor upgrade to a non-vulnerable release, The Ubuntu Security Team has triaged this, and thinks that it's a Low priority bug for several good reasons.

Looks like the vulnerability can only be triggered when cron is upgraded by apt by an attacker that is already a member of the crontab group (usually nobody is).

• Information: The cron package received NO post-release updates in 14.04, 16.04 so far, nor 18.04 so far. This vulnerability has a very, very limited window of opportunity - once every 6 months (or once every two years).

This means that you have several possible ways to lower your risk while some other community members test and backport the patch:

Here's an example:

1. You can apt-mark hold cron, so it does not update unobserved. The vulnerability is part of the postinstall script, which only runs when the cron package updates (or if you reinstall cron for whatever reason).

2. In a default install of Ubuntu, nobody is in the crontab group. You can check /etc/groups for any unexpected members of the crontab group, and remove them, before releasing the apt-hold and updating cron.

3. The exploit involves using dangling symlinks to fool the kernel. You can check for dangling symlinks in $crondir/crontabs before upgrading cron. Again, easy to spot using plain old ls -la, and takes only a moment to remove.

It's also important to point out to newer users that an intruder or malware that has gained access to the crontab group has already compromised your system, regardless of whether they gain root or not.