PT-2017-3611
CVE-2017-14177
·
Published
2017-10-21
·
Updated
2018-02-15
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
Apport versions prior to 2.20.8
Description:
The issue is related to Apport's handling of core dumps from setuid binaries, allowing local users to create certain files as root. This could be leveraged by an attacker to perform a denial of service via resource exhaustion or possibly gain root privileges. The vulnerability is a result of an incomplete fix for a previous issue.
Recommendations:
For Apport versions prior to 2.20.8, update to version 2.20.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of setuid binaries to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾