The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.

The remote host is affected by the vulnerability described in GLSA-201607-14 (Ansible: Privilege escalation)

    The create_script function in the lxc_container module of Ansible uses       predictable temporary file names, making it vulnerable to a symlink       attack.
  Impact :

    Local attackers could write arbitrary files or gain escalated privileges       within the container.
  Workaround :

    There is no known workaround at this time.

Update to 2.0.2.0.
https://github.com/ansible/ansible/blob/stable-2.0/CHANGELOG.md

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.9.6. Fixes bug #1327744 as well as CVE-2016-3096

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ansible developers report :

CVE-2016-3096: do not use predictable paths in lxc_container

- do not use a predictable filename for the LXC attach script

- don't use predictable filenames for LXC attach script logging

- don't set a predictable archive_path

this should prevent symlink attacks which could result in

- data corruption

- data leakage

- privilege escalation

ID	Name	Product	Family	Severity
92484	GLSA-201607-14 : Ansible: Privilege escalation	Nessus	Gentoo Local Security Checks	high
90958	Fedora 24 : ansible-2.0.2.0-1.fc24 (2016-679c4ddd3c)	Nessus	Fedora Local Security Checks	high
90817	Fedora 23 : ansible-2.0.2.0-1.fc23 (2016-cd3cf8e7d0)	Nessus	Fedora Local Security Checks	high
90816	Fedora 22 : ansible-2.0.2.0-1.fc22 (2016-ab154c56dd)	Nessus	Fedora Local Security Checks	high
90732	Fedora 23 : ansible1.9-1.9.6-1.fc23 (2016-65519440f5)	Nessus	Fedora Local Security Checks	high
90728	Fedora 22 : ansible1.9-1.9.6-1.fc22 (2016-28ff51a3f5)	Nessus	Fedora Local Security Checks	high
90606	FreeBSD : ansible -- use of predictable paths in lxc_container (253c6889-06f0-11e6-925f-6805ca0b3d42)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-3096

high

Tenable Plugins

high

high

high

high

high

high

high