CVE-2018-6557

What it actually does

The MOTD update script mishandles temporary files, enabling local symlink attacks that can overwrite arbitrary files, cause denial of service, or escalate privileges when kernel symlink restrictions are disabled.

Why it matters to the business

Systems running affected Ubuntu releases may experience unplanned outages or unauthorized local access, increasing operational risk on servers and workstations still using the vulnerable package.

How an attack unfolds

A local attacker creates a symlink in a predictable temporary-file location that the MOTD script follows, allowing file overwrite or service disruption; when kernel protections are absent the attacker can target privileged files to gain elevated access.

How to fix it

Upgrade the base-files package to a version that correctly handles temporary files; apply vendor updates for Ubuntu 18.04 LTS and 18.10 and verify the installed package version after the update.

How to confirm the fix worked

Confirm the installed base-files package version is at or above the fixed release; re-execute the MOTD update script under controlled conditions and verify no unexpected file modifications occur.

Typical attack path

1. Locate a system running an unpatched base-files package on Ubuntu 18.04 or 18.10
2. Create a malicious symlink pointing to a target file in the directory used by the MOTD update script
3. Trigger or wait for the periodic MOTD update to execute
4. Observe resulting denial of service or attempt privilege escalation via overwritten files

How to detect it

Review system logs for unexpected file modifications or errors from the MOTD update script; inspect temporary directories for recently created symlinks around the time the script runs.

What your security team should do

• Prioritize patching Ubuntu 18.04 LTS and 18.10 systems that still run the vulnerable base-files package
• Disable or restrict periodic MOTD updates on high-value systems until patched
• Audit local user accounts and scheduled jobs that could trigger the script
• Review kernel symlink-protection settings and enable them where supported