Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

Ubuntu 14.04 LTS: USN-2569-2 Critical: Apport Privilege Elevation

ubuntu
Calendar Grey April 16, 2015
Dist Ubuntu Esm H88
Kernel security patch USN-1234-5 for Ubuntu released on July 19, 2021, addressing a critical memory corruption vulnerability.
Apport could be tricked into running programs as an administrator.

Summary

Apport could be tricked into running programs as an administrator.

Software Description:

- apport: automatically generate crash reports for debugging

Details:

USN-2569-1 fixed a vulnerability in Apport. Tavis Ormandy discovered that

the fixed packages were still vulnerable to a privilege escalation attack.

This update completely disables crash report handling for containers until

a more complete solution is available.

Original advisory details:

Stéphane Graber and Tavis Ormandy independently discovered that Apport

incorrectly handled the crash reporting feature. A local attacker could use

this issue to gain elevated privileges.

Topics%20covered

Topics Covered

security advisory software update privilege escalation Ubuntu security notice apport

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  apport                          2.14.7-0ubuntu8.4

Ubuntu 14.04 LTS:
  apport                          2.14.1-0ubuntu3.10

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2569-2

https://ubuntu.com/security/notices/USN-2569-1

https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1444518

Severity
critical
Lowest
Low
Medium
High
Critical

April 16, 2015

Topics%20covered

Topics Covered

security advisory software update privilege escalation Ubuntu security notice apport

Package Information

https://launchpad.net/ubuntu/+source/apport/2.14.7-0ubuntu8.4
https://launchpad.net/ubuntu/+source/apport/2.14.1-0ubuntu3.10

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.