CVE-2015-9259
📋 TL;DR
This vulnerability in Docker Notary allows attackers to bypass security controls by using expired root.json files to sign malicious updates, despite the system claiming to check expiry. It affects all users of Docker Notary before version 0.1 who rely on it for secure software distribution.
💻 Affected Systems
- Docker Notary
📦 What is this software?
Notary by Docker
⚠️ Risk & Real-World Impact
Worst Case
Attackers can compromise the entire software supply chain by pushing malicious updates that appear legitimate, potentially leading to widespread system compromise.
Likely Case
Attackers with access to compromised keys can push malicious container images or software updates to unsuspecting users.
If Mitigated
With proper monitoring and key rotation policies, impact is limited to detection of anomalous signing activity.
🎯 Exploit Status
Requires access to compromised signing keys but the actual bypass is straightforward once keys are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1 and later
Vendor Advisory: https://docs.docker.com/notary/changelog/
Restart Required: Yes
Instructions:
1. Stop all Notary services. 2. Update to Notary version 0.1 or later. 3. Restart Notary services. 4. Rotate all signing keys as precaution.
🔧 Temporary Workarounds
Manual root.json expiry checking
allImplement custom validation to check root.json expiry dates before accepting updates
# Custom script to validate root.json expiry
# Check timestamp in root.json against current time
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Notary servers from untrusted networks
- Enable comprehensive logging and monitoring of all Notary signing activities for anomalies
🔍 How to Verify
Check if Vulnerable:
Check Notary version: if version is below 0.1, system is vulnerableCheck Version:
notary versionVerify Fix Applied:
Verify Notary version is 0.1 or higher and test that expired root.json files are rejected📡 Detection & Monitoring
Log Indicators:
- Multiple failed signature validations
- Use of old root.json files after key rotation
- Unexpected signing activity from unusual sources
Network Indicators:
- Unusual patterns of update downloads
- Connections to Notary servers from unexpected IPs
SIEM Query:
source="notary" AND (event="signature_validation_failed" OR event="old_root_used")🔗 References
- https://docs.docker.com/notary/changelog/
- https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf
- https://docs.docker.com/notary/changelog/
- https://github.com/theupdateframework/notary/blob/master/docs/resources/ncc_docker_notary_audit_2015_07_31.pdf
