PT-2016-7887 · Canonical · Apport-Gtk+2

Donncha Ocearbhaill · Published 2016-12-14 · Updated 2017-01-07 · CVE-2016-9951

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apport versions prior to 2.20.4

Description An issue was discovered where a malicious Apport crash file can contain a restart command in RespawnCommand or ProcCmdline fields, which will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file.

Recommendations For Apport versions prior to 2.20.4, the fix is to only show the Relaunch button on Apport crash files generated by local systems, and hide the Relaunch button when crash files are opened directly in Apport-GTK.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-9951

USN-3157-1

Affected Products

Apport

Apport-Gtk

Ubuntu

References · 15

• 🔥 https://github.com/DonnchaC/ubuntu-apport-exploitation · Exploit
• 🔥 https://exploit-db.com/exploits/40937 · Exploit
• 🔥 https://donncha.is/2016/12/compromising-ubuntu-desktop · Exploit
• https://osv.dev/vulnerability/USN-3157-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9951 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3157-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-3157-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9951 · Security Note
• https://bugs.launchpad.net/apport/+bug/1648806 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9951 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9951 · Security Note
• https://ubuntu.com/security/CVE-2016-9950 · Vendor Advisory
• http://securityfocus.com/bid/95011 · Note