PT-2020-3507 · Canonical+1 · Apport+2

Seong-Joong Kim · Published 2020-05-13 · Updated 2023-01-24 · CVE-2020-15701

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions apport versions prior to 2.20.1-0ubuntu2.24 apport versions prior to 2.20.9-0ubuntu7.16 apport versions prior to 2.20.11-0ubuntu27.6

Description The issue is related to an unhandled exception in the check ignored() function in apport/report.py, which can be exploited by a local attacker to cause a denial of service. Specifically, if the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash.

Recommendations For versions prior to 2.20.1-0ubuntu2.24, update to version 2.20.1-0ubuntu2.24 or later. For versions prior to 2.20.9-0ubuntu7.16, update to version 2.20.9-0ubuntu7.16 or later. For versions prior to 2.20.11-0ubuntu27.6, update to version 2.20.11-0ubuntu27.6 or later. As a temporary workaround, consider disabling the check ignored() function until a patch is available.

Exploit

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BDU:2020-03838

CVE-2020-15701

USN-4449-1

USN-4449-2

Affected Products

Linuxmint

Ubuntu

Apport

References · 16

• 🔥 https://launchpad.net/bugs/1877023 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15701 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03838 · Security Note
• https://usn.ubuntu.com/4449-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4449-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15701 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-15701 · Security Note
• https://ubuntu.com/security/CVE-2020-11936 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15702 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4449-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15701 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15701 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4449-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4449-2 · Vendor Advisory
• https://usn.ubuntu.com/4449-2 · Vendor Advisory