USN-6018-1: Apport vulnerability
Chen Lu, Lei Wang, and YiQi Sun discovered a privilege escalation vulnerability in apport-cli when viewing crash reports and unprivileged users are allowed to run sudo less. A local attacker on a specially configured system could use this to escalate their privilege.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/apportto a version that resolves this vulnerability.Fixed in 2.23.1-0ubuntu3.2 - Upgrade
Upgrade
ubuntu/apportto a version that resolves this vulnerability.Fixed in 2.20.11-0ubuntu82.4 - Upgrade
Upgrade
ubuntu/apportto a version that resolves this vulnerability.Fixed in 2.20.11-0ubuntu27.26 - Upgrade
Upgrade
ubuntu/apportto a version that resolves this vulnerability.Fixed in 2.20.9-0ubuntu7.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch USN-6018-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apport vulnerability?
The vulnerability ID for this Apport vulnerability is USN-6018-1.
What is the severity of the USN-6018-1 vulnerability?
The severity of the USN-6018-1 vulnerability is not specified.
What is Apport?
Apport is a crash report handling tool in Ubuntu.
How does the privilege escalation vulnerability in Apport work?
The vulnerability allows local attackers on a specially configured system to escalate their privilege by exploiting apport-cli when viewing crash reports and unprivileged users are allowed to run sudo less.
How do I fix the USN-6018-1 vulnerability in Apport?
To fix the USN-6018-1 vulnerability in Apport, update the apport package to version 2.23.1-0ubuntu3.2 or higher.