binutils の脆弱性 (USN-4336-2)

概要

binutils に脆弱性 (USN-4336-2) が存在。不正な操作・情報露出のリスクがあります。対策: `2.26.1-1ubuntu1~16.04.8+esm1` 以上に更新。

AI要約 snake-internal / snake-material-v2

binutils という製品で、USN-4336-2 という番号がついた弱点 (脆弱性) が見つかりました。不正な操作・情報露出のリスクがあります。重要度は CVSS スコア ?/10 です。対策: binutils を **2.26.1-1ubuntu1~16.04.8+esm1** 以上に更新してください。心配なら、システム担当者や製品の公式サイトで「binutils USN-4336-2」を検索してください。

USN-4336-2 (binutils) — 修正バージョン: `2.26.1-1ubuntu1~16.04.8+esm1` (即時適用推奨) 対応方針: 1) SBOMで影響バージョン横断確認, 2) ステージング検証→本番更新, 3) WAF/プロキシで該当エンドポイントを監視, 4) ログでIOC調査。参考: 当ページの『参照URL』の GHSA / vendor advisory / patched release を参照。

❓ 何が問題か

binutils に **脆弱性** (分類未定) があります。

📍 影響範囲

binutils のうち。

🔥 重要度

重要度: ?。不正な操作・情報露出のリスクがあります

🔧 修正方法

**2.26.1-1ubuntu1~16.04.8+esm1** に更新してください。

🛡️ 暫定回避

修正版が未提供時は、影響機能の無効化・WAFルール・ネットワークACLでの遮断を検討。

🔍 検知方法

Webサーバ・プロキシ・WAFログで該当CVEのIOCに合致する不審リクエストを検索。SBOM/依存ファイルで影響バージョンを横断確認。

対応アクション (7段階)

SOC/SREチームが順番に実行すべき具体的なステップとコマンド例

1
影響範囲の特定 identify
```
grep -r 'binutils' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で `binutils` を grep し、稼働しているサービス・バージョンを把握する。
6
パッチ適用 patch
```
Upgrade binutils to 2.26.1-1ubuntu1~16.04.8+esm1
```
ステージング環境で 2.26.1-1ubuntu1~16.04.8+esm1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 3 で見つけた異常検知の続報チェックを含めること。
7
事後検証 verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

影響パッケージ

Ubuntu:Pro:16.04:LTS binutils

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-1ubuntu1~16.04.8+esm1"}]}]

参照URL

advisory https://ubuntu.com/security/notices/USN-4336-2
report https://ubuntu.com/security/CVE-2016-2226
report https://ubuntu.com/security/CVE-2016-4487
report https://ubuntu.com/security/CVE-2016-4488
report https://ubuntu.com/security/CVE-2016-4489
report https://ubuntu.com/security/CVE-2016-4490
report https://ubuntu.com/security/CVE-2016-4491
report https://ubuntu.com/security/CVE-2016-4492
report https://ubuntu.com/security/CVE-2016-4493
report https://ubuntu.com/security/CVE-2016-6131
report https://ubuntu.com/security/CVE-2017-6965
report https://ubuntu.com/security/CVE-2017-6966
report https://ubuntu.com/security/CVE-2017-6969
report https://ubuntu.com/security/CVE-2017-7209
report https://ubuntu.com/security/CVE-2017-7210
report https://ubuntu.com/security/CVE-2017-7223
report https://ubuntu.com/security/CVE-2017-7224
report https://ubuntu.com/security/CVE-2017-7225
report https://ubuntu.com/security/CVE-2017-7226
report https://ubuntu.com/security/CVE-2017-7227
report https://ubuntu.com/security/CVE-2017-7299
report https://ubuntu.com/security/CVE-2017-7300
report https://ubuntu.com/security/CVE-2017-7301
report https://ubuntu.com/security/CVE-2017-7302
report https://ubuntu.com/security/CVE-2017-7614
report https://ubuntu.com/security/CVE-2017-8393
report https://ubuntu.com/security/CVE-2017-8394
report https://ubuntu.com/security/CVE-2017-8395
report https://ubuntu.com/security/CVE-2017-8396
report https://ubuntu.com/security/CVE-2017-8397
report https://ubuntu.com/security/CVE-2017-8398
report https://ubuntu.com/security/CVE-2017-8421
report https://ubuntu.com/security/CVE-2017-9038
report https://ubuntu.com/security/CVE-2017-9039
report https://ubuntu.com/security/CVE-2017-9040
report https://ubuntu.com/security/CVE-2017-9041
report https://ubuntu.com/security/CVE-2017-9042
report https://ubuntu.com/security/CVE-2017-9044
report https://ubuntu.com/security/CVE-2017-9742
report https://ubuntu.com/security/CVE-2017-9744
report https://ubuntu.com/security/CVE-2017-9745
report https://ubuntu.com/security/CVE-2017-9746
report https://ubuntu.com/security/CVE-2017-9747
report https://ubuntu.com/security/CVE-2017-9748
report https://ubuntu.com/security/CVE-2017-9749
report https://ubuntu.com/security/CVE-2017-9750
report https://ubuntu.com/security/CVE-2017-9751
report https://ubuntu.com/security/CVE-2017-9752
report https://ubuntu.com/security/CVE-2017-9753
report https://ubuntu.com/security/CVE-2017-9754
report https://ubuntu.com/security/CVE-2017-9755
report https://ubuntu.com/security/CVE-2017-9756
report https://ubuntu.com/security/CVE-2017-9954
report https://ubuntu.com/security/CVE-2017-12448
report https://ubuntu.com/security/CVE-2017-12449
report https://ubuntu.com/security/CVE-2017-12450
report https://ubuntu.com/security/CVE-2017-12451
report https://ubuntu.com/security/CVE-2017-12452
report https://ubuntu.com/security/CVE-2017-12453
report https://ubuntu.com/security/CVE-2017-12454
report https://ubuntu.com/security/CVE-2017-12455
report https://ubuntu.com/security/CVE-2017-12456
report https://ubuntu.com/security/CVE-2017-12457
report https://ubuntu.com/security/CVE-2017-12458
report https://ubuntu.com/security/CVE-2017-12459
report https://ubuntu.com/security/CVE-2017-12799
report https://ubuntu.com/security/CVE-2017-12967
report https://ubuntu.com/security/CVE-2017-13710
report https://ubuntu.com/security/CVE-2017-14128
report https://ubuntu.com/security/CVE-2017-14129
report https://ubuntu.com/security/CVE-2017-14130
report https://ubuntu.com/security/CVE-2017-14333
report https://ubuntu.com/security/CVE-2017-14529
report https://ubuntu.com/security/CVE-2017-14930
report https://ubuntu.com/security/CVE-2017-14932
report https://ubuntu.com/security/CVE-2017-14938
report https://ubuntu.com/security/CVE-2017-14939
report https://ubuntu.com/security/CVE-2017-14940
report https://ubuntu.com/security/CVE-2017-15020
report https://ubuntu.com/security/CVE-2017-15021
report https://ubuntu.com/security/CVE-2017-15022
report https://ubuntu.com/security/CVE-2017-15024
report https://ubuntu.com/security/CVE-2017-15025
report https://ubuntu.com/security/CVE-2017-15225
report https://ubuntu.com/security/CVE-2017-15938
report https://ubuntu.com/security/CVE-2017-15939
report https://ubuntu.com/security/CVE-2017-15996
report https://ubuntu.com/security/CVE-2017-16826
report https://ubuntu.com/security/CVE-2017-16827
report https://ubuntu.com/security/CVE-2017-16828
report https://ubuntu.com/security/CVE-2017-16831
report https://ubuntu.com/security/CVE-2017-16832
report https://ubuntu.com/security/CVE-2017-17080
report https://ubuntu.com/security/CVE-2017-17121
report https://ubuntu.com/security/CVE-2017-17123
report https://ubuntu.com/security/CVE-2017-17124
report https://ubuntu.com/security/CVE-2017-17125
report https://ubuntu.com/security/CVE-2018-6323
report https://ubuntu.com/security/CVE-2018-6543
report https://ubuntu.com/security/CVE-2018-6759
report https://ubuntu.com/security/CVE-2018-7208
report https://ubuntu.com/security/CVE-2018-7568
report https://ubuntu.com/security/CVE-2018-7569
report https://ubuntu.com/security/CVE-2018-7642
report https://ubuntu.com/security/CVE-2018-7643
report https://ubuntu.com/security/CVE-2018-8945
report https://ubuntu.com/security/CVE-2018-9138
report https://ubuntu.com/security/CVE-2018-10372
report https://ubuntu.com/security/CVE-2018-10373
report https://ubuntu.com/security/CVE-2018-10534
report https://ubuntu.com/security/CVE-2018-10535
report https://ubuntu.com/security/CVE-2018-12641
report https://ubuntu.com/security/CVE-2018-12697
report https://ubuntu.com/security/CVE-2018-12698
report https://ubuntu.com/security/CVE-2018-12699
report https://ubuntu.com/security/CVE-2018-12700
report https://ubuntu.com/security/CVE-2018-12934
report https://ubuntu.com/security/CVE-2018-13033
report https://ubuntu.com/security/CVE-2018-17358
report https://ubuntu.com/security/CVE-2018-17359
report https://ubuntu.com/security/CVE-2018-17360
report https://ubuntu.com/security/CVE-2018-17794
report https://ubuntu.com/security/CVE-2018-17985
report https://ubuntu.com/security/CVE-2018-18309
report https://ubuntu.com/security/CVE-2018-18483
report https://ubuntu.com/security/CVE-2018-18484
report https://ubuntu.com/security/CVE-2018-18605
report https://ubuntu.com/security/CVE-2018-18606
report https://ubuntu.com/security/CVE-2018-18607
report https://ubuntu.com/security/CVE-2018-18700
report https://ubuntu.com/security/CVE-2018-18701
report https://ubuntu.com/security/CVE-2018-19931
report https://ubuntu.com/security/CVE-2018-19932
report https://ubuntu.com/security/CVE-2018-20002
report https://ubuntu.com/security/CVE-2018-20623
report https://ubuntu.com/security/CVE-2018-20671
report https://ubuntu.com/security/CVE-2018-1000876
report https://ubuntu.com/security/CVE-2019-9070
report https://ubuntu.com/security/CVE-2019-9071
report https://ubuntu.com/security/CVE-2019-9073
report https://ubuntu.com/security/CVE-2019-9074
report https://ubuntu.com/security/CVE-2019-9075
report https://ubuntu.com/security/CVE-2019-9077
report https://ubuntu.com/security/CVE-2019-12972
report https://ubuntu.com/security/CVE-2019-14250
report https://ubuntu.com/security/CVE-2019-14444
report https://ubuntu.com/security/CVE-2019-17450
report https://ubuntu.com/security/CVE-2019-17451

概要

AI要約 snake-internal / snake-material-v2

対応アクション (7段階)

影響パッケージ

参照URL

🍪 Cookie について