PT-2017-3610 · Canonical+1 · Apport+1

Sander Bos · Publicado 2017-10-21 · Atualizado 2025-11-03 · CVE-2017-14179

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apport versions prior to 2.13

Description: The issue is related to uncontrolled resource consumption in the Apport error reporting software in the Ubuntu operating system. Exploitation of this issue could allow an attacker to cause a denial of service, escape from Linux Containers (LXC), or gain root privileges by leveraging files that Apport can create as root in the event of a crash. This can be achieved by local users creating certain files as root, which can then be used to perform malicious actions.

Recommendations: For Apport versions prior to 2.13, update to version 2.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of Apport to minimize the risk of exploitation. Avoid using Apport in environments where it can be exploited by local users until the issue is resolved.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BDU:2018-00583

CVE-2017-14179

Produtos afetados

Apport

Linux Containers

Referências · 10

• https://bdu.fstec.ru/vul/2018-00583 · Nota de Segurança
• https://launchpad.net/bugs/1726372 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14179 · Nota de Segurança
• https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179 · Nota
• https://ubuntu.com/security/CVE-2017-14179 · Aviso do Fabricante
• https://t.me/cveNotify/141418 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14179 · Aviso do Fabricante
• http://sbosnet.nl · Nota
• https://osv.dev/vulnerability/CVE-2017-14179 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-14179 · Nota de Segurança