# Mobian Security Update #1

DevFeed: [Mobian Security Update #1](<https://devfeed.tech/articles/mobian-security-update-1-34236.md>)

Original publisher: [Read original article](<https://blog.mobian.org/posts/2023/08/31/mobian-bookworm-security-update/>)

Author: Mobian team

Published: 2023-08-31T02:00:00Z

Content type: release

Language: en

Sources: [Mobian's Blog](<https://devfeed.tech/sources/mobian-s-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [apt](<https://devfeed.tech/topics/apt.md>), [Package manager](<https://devfeed.tech/topics/package-manager.md>), [upgrade](<https://devfeed.tech/topics/upgrade.md>)

Tags: [apt](<https://devfeed.tech/tags/apt.md>), [packages](<https://devfeed.tech/tags/packages.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [root](<https://devfeed.tech/tags/root.md>), [security](<https://devfeed.tech/tags/security.md>), [update](<https://devfeed.tech/tags/update.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

The Mobian Team released a security update for a local vulnerability in Bookworm images. Some files had global write permissions, including files managing apt configuration, creating a possible privilege-escalation path to root for a local user with access to an unlocked or already compromised device. Mobian users should upgrade the specified mobian-tweaks-common package.

## Source excerpt

The Mobian Team have recently released a security update fixing a local vulnerability caused by a bug in our Bookworm images. User Action Required Mobian users must install the following package in order to address the issues described in this post. A normal upgrade which can be done using sudo apt update && sudo apt upgrade or via Gnome Software will take care of this. For Bookworm users: mobian-tweaks-common, version 0.5.6+deb12u1 For Trixie and Staging users: mobian-tweaks-common, version 0.5.9 These packages include an install script which fixes the permissions on the effected files. They are currently in the staging and bookworm-updates repositories and will migrate to trixie and bookworm in the coming week. Summary The Bookworm images released earlier this year had a small number of files with global write permissions. As two of these files manage the configuration of the apt package manager, they provide an attacker with a useful privilege escalation method. This issue seems to only affect the released Bookworm images, though a full audit of weekly images has not been undertaken. Users who installed on Trixie were likely never effected. Impact These files could allow a local user to gain root access to the device by modifying them and waiting for the user to install an attacker provided update. This attack would require access to an unlocked or otherwise already compromised device as a standard user. There is no way to carry this attack out remotely or on a locked device. Indicators of Compromise Users can verify the current configuration of their system by checking the relevant files. Changes to these files to not immediately mean the device has been compromised, but may warrant further investigation. /etc/apt/sources.list.d/mobian.list should contain (potentially with a different distribution): deb http://repo.mobian.org/ <distribution> main non-free-firmware /etc/apt/trusted.gpg.d/mobian.gpg can be verified using the command shasum -c checksum.txt aganist