PT-2019-4928 · Canonical · Apport+1

Kevin Backhouse · Published 2019-05-29 · Updated 2023-06-12 · CVE-2019-7307

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apport versions prior to 2.14.1-0ubuntu3.29+esm1 Apport versions prior to 2.20.1-0ubuntu2.19 Apport versions prior to 2.20.9-0ubuntu7.7 Apport versions prior to 2.20.10-0ubuntu27.1 Apport versions prior to 2.20.11-0ubuntu5

Description The issue is caused by a Time-of-Check-to-Time-of-Use (TOCTTOU) vulnerability when reading the user's ~/.apport-ignore.xml file. This allows a local attacker to replace this file with a symlink to any other file on the system, causing Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user, either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, allowing the user to read arbitrary files on the system.

Recommendations For versions prior to 2.14.1-0ubuntu3.29+esm1, update to version 2.14.1-0ubuntu3.29+esm1 or later. For versions prior to 2.20.1-0ubuntu2.19, update to version 2.20.1-0ubuntu2.19 or later. For versions prior to 2.20.9-0ubuntu7.7, update to version 2.20.9-0ubuntu7.7 or later. For versions prior to 2.20.10-0ubuntu27.1, update to version 2.20.10-0ubuntu27.1 or later. For versions prior to 2.20.11-0ubuntu5, update to version 2.20.11-0ubuntu5 or later. As a temporary workaround, consider restricting access to the ~/.apport-ignore.xml file to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Time Of Check To Time Of Use

Weakness Enumeration

CWE-362

CWE-367

Related Identifiers

BDU:2020-01533

CVE-2019-7307

USN-4051-1

USN-4051-2

Affected Products

Apport

Ubuntu

References · 17

• 🔥 https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1830858 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7307 · Security Note
• https://ubuntu.com/security/notices/USN-4051-2 · Vendor Advisory
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-7307.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01533 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7307 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4051-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4051-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-7307 · Security Note
• https://osv.dev/vulnerability/USN-4051-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7307 · Vendor Advisory
• https://usn.ubuntu.com/4051-1 · Note
• http://packetstormsecurity.com/files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html · Note
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-7307.html?_ga=2.56548715.1956740741.1562562369-1618695258.1547637860 · Note