Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 17.10 USN-3480-2 Critical: Apport Regression Fix

ubuntu
Calendar Grey November 20, 2017
Scroller Ubuntu
Ubuntu Security Announcement USN-3480-2 resolves issues related to Apport that impact multiple versions of Ubuntu.
USN-3480-1 introduced regressions in Apport.

Summary

USN-3480-1 introduced regressions in Apport.

Software Description:

- apport: automatically generate crash reports for debugging

Details:

USN-3480-1 fixed vulnerabilities in Apport. The fix for CVE-2017-14177

introduced a regression in the ability to handle crashes for users that

configured their systems to use the Upstart init system in Ubuntu 16.04

LTS and Ubuntu 17.04. The fix for CVE-2017-14180 temporarily disabled

crash forwarding to containers. This update addresses the problems.

We apologize for the inconvenience.

Original advisory details:

Sander Bos discovered that Apport incorrectly handled core dumps for setuid

binaries. A local attacker could use this issue to perform a denial of service

via resource exhaustion or possibly gain root privileges. (CVE-2017-14177)

Sander Bos discovered that Apport incorrectly handled core dumps for processes

in a different PID namespace. A local attacker could use this issue to perform

a denial of service via resource exhaustio...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical issue system update ubuntu apport regressions

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
  apport                          2.20.7-0ubuntu3.5

Ubuntu 17.04:
  apport                          2.20.4-0ubuntu4.8

Ubuntu 16.04 LTS:
  apport                          2.20.1-0ubuntu2.13

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3480-2

https://ubuntu.com/security/notices/USN-3480-1

https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1726372, https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1732518

Severity
critical
Lowest
Low
Medium
High
Critical

November 20, 2017

Topics%20covered

Topics Covered

security advisory denial of service critical issue system update ubuntu apport regressions

Package Information

https://launchpad.net/ubuntu/+source/apport/2.20.7-0ubuntu3.5
https://launchpad.net/ubuntu/+source/apport/2.20.4-0ubuntu4.8
https://launchpad.net/ubuntu/+source/apport/2.20.1-0ubuntu2.13

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.