Ubuntu 13.10: Apport Critical Threat Information Exposure

ubuntu

October 24, 2013

Apport could be made to expose privileged information.

Summary

Apport could be made to expose privileged information.

Software Description:

- apport: automatically generate crash reports for debugging

Details:

Martin Carpenter discovered that Apport set incorrect permissions on core

dump files generated by setuid binaries. A local attacker could possibly

use this issue to obtain privileged information.

Topics Covered

security advisory critical threat local attack information exposure ubuntu apport

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  apport                          2.12.5-0ubuntu2.1

Ubuntu 13.04:
  apport                          2.9.2-0ubuntu8.5

Ubuntu 12.10:
  apport                          2.6.1-0ubuntu13

Ubuntu 12.04 LTS:
  apport                          2.0.1-0ubuntu17.6

In general, a standard system update will make all the necessary changes.