Sander Bos

Name of the Vulnerable Software and Affected Versions: CISOfy Lynis versions 2.x through 2.7.5 Description: The issue allows an attacker to obtain the license key by examining the process list during a data upload. This license key can then be used to upload data to a central Lynis server, potentially allowing the upload of additional scan data. However, it is noted that knowing the license key does not enable data extraction. Recommendations: For CISOfy Lynis versions 2.x through 2.7.5, consider restricting access to the process list during data uploads to minimize the risk of the license key being obtained. As a temporary workaround, restrict the ability to upload data to the central Lynis server until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Byobu Apport hook may disclose sensitive information. It automatically uploads the local user's .screenrc file, which may contain private hostnames, usernames, and passwords.

The issue allows the /usr/ and /etc/extplorer/ system directories to be world-accessible over HTTP, potentially leading to data leakage, information disclosure, and remote code execution on the web server. This is due to changes introduced in the Makefile patch files debian/patches/debian-changes-2.1.0b6+dfsg-1 or debian/patches/adds-a-makefile.patch.

The issue is related to Apport's lock file being in a world-writable directory, allowing all users to prevent crash handling. This can lead to a denial of service. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to Apport's handling of crash dumps from containers, which could allow a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. This is due to insufficient access control in the error logging service, potentially enabling an attacker to create a publicly accessible report for a privileged process.

A time of check to time of use (TOCTTOU) vulnerability was discovered in apport, allowing a user to cause core files to be written in arbitrary directories. The issue is related to synchronization errors when using a shared resource, which can be exploited to create a public crash report for a privileged process.

The MOTD update script in the base-files package incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.

The issue allows local users to create certain files as root, potentially leading to denial of service via resource exhaustion, gaining root privileges, or escaping from containers. This is due to the `is same ns()` function returning True when `/proc/<global pid>/` does not exist, indicating the crash should be handled in the global namespace rather than inside a container. However, the portion of the data/apport code that decides whether to forward a crash to a container does not always replace `sys.argv[1]` with the value stored in the `host pid` variable when `/proc/<global pid>/` does not exist, resulting in the container pid being used in the global namespace.

Name of the Vulnerable Software and Affected Versions: Apport versions prior to 2.13 Description: The issue is related to uncontrolled resource consumption in the Apport error reporting software in the Ubuntu operating system. Exploitation of this issue could allow an attacker to cause a denial of service, escape from Linux Containers (LXC), or gain root privileges by leveraging files that Apport can create as root in the event of a crash. This can be achieved by local users creating certain files as root, which can then be used to perform malicious actions. Recommendations: For Apport versions prior to 2.13, update to version 2.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of Apport to minimize the risk of exploitation. Avoid using Apport in environments where it can be exploited by local users until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Apport versions 2.13 through 2.20.7 Description: The issue is related to Apport's handling of crashes from a PID namespace, allowing local users to create files as root. This could be exploited to cause a denial of service via resource exhaustion or potentially gain root privileges. The vulnerability is associated with uncontrolled resource consumption and can be exploited to cause a denial of service or gain root privileges using files created by Apport as root in the event of a crash. Recommendations: For Apport versions 2.13 through 2.20.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Apport versions prior to 2.20.8 Description: The issue is related to Apport's handling of core dumps from setuid binaries, allowing local users to create certain files as root. This could be leveraged by an attacker to perform a denial of service via resource exhaustion or possibly gain root privileges. The vulnerability is a result of an incomplete fix for a previous issue. Recommendations: For Apport versions prior to 2.20.8, update to version 2.20.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of setuid binaries to minimize the risk of exploitation.

The issue allows local users to obtain the CA key due to a problem in the pulp-qpid-ssl-cfg script.

The issue allows local users to leak keys or write to arbitrary files via a symlink attack, specifically targeting the pulp-gen-nodes-certificate script in Pulp.

The issue arises from the insecure creation of a temporary directory during CA key generation.

The issue is related to insufficient access control in the Apport service of the Ubuntu operating system. It can be exploited by a local attacker to gain root privileges and modify arbitrary files due to incorrect handling of permissions when creating core dumps for setuid binaries.