CVE-2019-7307: Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml
First published: Thu Aug 29 2019(Updated: )
Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.
Credit: security@ubuntu.com security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apport Project Apport | =2.14.1 | |
| Canonical Ubuntu Linux | =14.04 | |
| Apport Project Apport | =2.20.1 | |
| Canonical Ubuntu Linux | =16.04 | |
| Apport Project Apport | =2.20.9 | |
| Canonical Ubuntu Linux | =18.04 | |
| Apport Project Apport | =2.20.10 | |
| Canonical Ubuntu Linux | =19.10 | |
| Canonical Ubuntu Linux | =19.04 | |
| All of | ||
| Apport Project Apport | =2.14.1 | |
| Canonical Ubuntu Linux | =14.04 | |
| All of | ||
| Apport Project Apport | =2.20.1 | |
| Canonical Ubuntu Linux | =16.04 | |
| All of | ||
| Apport Project Apport | =2.20.9 | |
| Canonical Ubuntu Linux | =18.04 | |
| All of | ||
| Apport Project Apport | =2.20.10 | |
| Canonical Ubuntu Linux | =19.10 | |
| All of | ||
| Apport Project Apport | =2.20.10 | |
| Canonical Ubuntu Linux | =19.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html
- https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1830858
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-7307.html
- https://launchpad.net/bugs/cve/CVE-2019-7307
- https://security-tracker.debian.org/tracker/CVE-2019-7307
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7307
- https://nvd.nist.gov/vuln/detail/CVE-2019-7307
- https://ubuntu.com/security/CVE-2019-7307
- collector/nvd-index
- agent/type
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/author
- agent/weakness
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/apport project
- canonical/apport project apport
- version/apport project apport/2.14.1
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/apport project apport/2.20.1
- version/canonical ubuntu linux/16.04
- version/apport project apport/2.20.9
- version/canonical ubuntu linux/18.04
- version/apport project apport/2.20.10
- version/canonical ubuntu linux/19.10
- version/canonical ubuntu linux/19.04