PT-2016-7886 · Canonical · Apport+1

Donncha Ocearbhaill · Published 2016-12-14 · Updated 2017-01-07 · CVE-2016-9950

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apport versions prior to 2.20.4

Description An issue was discovered in Apport, where a path traversal issue exists in the "Package" and SourcePackage fields of the Apport crash file. These fields are used to build a path to the package specific hook files in the "/usr/share/apport/package-hooks/" directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.

Recommendations For versions prior to 2.20.4, update to version 2.20.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the package specific hook files in the /usr/share/apport/package-hooks/ directory to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-9950

USN-3157-1

Affected Products

Apport

Ubuntu

References · 15

• 🔥 https://github.com/DonnchaC/ubuntu-apport-exploitation · Exploit
• 🔥 https://exploit-db.com/exploits/40937 · Exploit
• 🔥 https://donncha.is/2016/12/compromising-ubuntu-desktop · Exploit
• https://osv.dev/vulnerability/USN-3157-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3157-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9950 · Security Note
• http://ubuntu.com/usn/USN-3157-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9950 · Security Note
• https://bugs.launchpad.net/apport/+bug/1648806 · Patch
• https://ubuntu.com/security/CVE-2016-9949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9951 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9950 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9950 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9950 · Vendor Advisory
• http://securityfocus.com/bid/95011 · Note