PT-2017-3611 · Canonical · Apport+1

Sander Bos · Published 2017-10-21 · Updated 2018-02-15 · CVE-2017-14177

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apport versions prior to 2.20.8

Description: The issue is related to Apport's handling of core dumps from setuid binaries, allowing local users to create certain files as root. This could be leveraged by an attacker to perform a denial of service via resource exhaustion or possibly gain root privileges. The vulnerability is a result of an incomplete fix for a previous issue.

Recommendations: For Apport versions prior to 2.20.8, update to version 2.20.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of setuid binaries to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2018-00584

CVE-2017-14177

USN-3480-1

USN-3480-2

USN-3480-3

Affected Products

Apport

Ubuntu

References · 20

• https://osv.dev/vulnerability/USN-3480-2 · Vendor Advisory
• https://usn.ubuntu.com/usn/usn-3480-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3480-3 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3480-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3480-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3480-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14177 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-14177 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14177 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14180 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3480-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14177 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00584 · Security Note
• https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14177 · Note