CVE-2009-1295

2009-04-3000:00:00

ubuntu.com

1.9 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10,
and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files
from the application’s crash-report directory, which allows local users to
delete arbitrary files via unspecified vectors.

Bugs

<https://bugs.edge.launchpad.net/apport/+bug/357024>

Notes

Author	Note
jdstrand	bug mentions fuse being an attack vector, but it isn’t on Jaunty symlink/race condition

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchapport< 0.108.4UNKNOWN
ubuntu8.10noarchapport< 0.119.2UNKNOWN
ubuntu9.04noarchapport< 1.0-0ubuntu5.2UNKNOWN