USN-4707-1: TCMU vulnerability

28 January 2021

tcmu could be made to crash if it received specially crafted input.

Releases

Packages

  • tcmu - TCM-Userspace backend

Details

It was discovered that TCMU lacked a check for transport-layer restrictions,
allowing remote attackers to read or write files via directory traversal in
an XCOPY request.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.10
Ubuntu 20.04

In general, a standard system update will make all the necessary changes.

References