PT-2017-3611 · Canonical · Apport+1

Sander Bos · Publicado 2017-10-21 · Atualizado 2018-02-15 · CVE-2017-14177

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apport versions prior to 2.20.8

Description: The issue is related to Apport's handling of core dumps from setuid binaries, allowing local users to create certain files as root. This could be leveraged by an attacker to perform a denial of service via resource exhaustion or possibly gain root privileges. The vulnerability is a result of an incomplete fix for a previous issue.

Recommendations: For Apport versions prior to 2.20.8, update to version 2.20.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of setuid binaries to minimize the risk of exploitation.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BDU:2018-00584

CVE-2017-14177

USN-3480-1

USN-3480-2

USN-3480-3

Produtos afetados

Apport

Ubuntu

Referências · 20

• https://osv.dev/vulnerability/USN-3480-2 · Aviso do Fabricante
• https://usn.ubuntu.com/usn/usn-3480-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3480-3 · Aviso do Fabricante
• https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14177 · Nota
• https://ubuntu.com/security/notices/USN-3480-2 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3480-1 · Aviso do Fabricante
• http://sbosnet.nl · Nota
• https://osv.dev/vulnerability/USN-3480-3 · Aviso do Fabricante
• https://launchpad.net/bugs/1726372 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14177 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-14177 · Nota de Segurança
• https://launchpad.net/bugs/1733366 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14177 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-14177 · Aviso do Fabricante
• https://launchpad.net/bugs/1732518 · Nota