CVE-2015-1336

What it actually does

The daily mandb cleanup job performs chown operations without proper validation or sanitization of target paths, allowing a local user with access to the man account to influence file ownership and escalate privileges on the system.

Why it matters to the business

Compromise of the low-privileged man account can lead to full root-level control of affected Linux systems, enabling attackers to install persistent malware, access sensitive data, or disrupt operations across Ubuntu and Debian environments.

How an attack unfolds

An attacker first obtains access to the man account, then creates or modifies files and directories in locations processed by the mandb cleanup job; when the job executes it performs an insecure chown that transfers ownership of attacker-controlled content to root or another privileged user, completing the escalation.

How to fix it

Upgrade man-db to a patched release that eliminates the insecure chown usage in the cleanup job; restrict the man account to the minimum required permissions and review any custom cron jobs that invoke mandb.

How to confirm the fix worked

Confirm the installed man-db package version is newer than the vulnerable release, inspect the cleanup script for safe path handling before chown, and run the job under a non-privileged test account to verify no unintended ownership changes occur.

Typical attack path

1. Obtain local access to the man account via credential theft, misconfiguration, or prior foothold
2. Prepare symbolic links or directories that point to sensitive system paths
3. Wait for or trigger execution of the daily mandb cleanup cron job
4. Leverage resulting ownership changes to execute code or access files as root

How to detect it

Review system logs for mandb or cron job executions that coincide with unexpected chown or ownership events on man-related directories; inspect process creation logs for the man user spawning privileged operations.

• mandb.*chown
• /var/cache/man
• cron.*man-db

What your security team should do

• Prioritize patching man-db across all Ubuntu and Debian systems
• Audit and harden access to the man account and related cron jobs
• Monitor for unexpected file ownership changes on man page cache directories
• Implement least-privilege controls so the man account cannot influence arbitrary paths