Vulners
Lucene search
Ubuntu Apport - Local Privilege Escalation Exploit
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | Apport Denial of Service Vulnerability | 4 Oct 201500:00 | – | cnvd |
 | CVE-2015-1338 | 1 Oct 201520:00 | – | cve |
 | CVE-2015-1338 | 1 Oct 201520:00 | – | cvelist |
 | EUVD-2015-1478 | 7 Oct 202500:30 | – | euvd |
 | CVE-2015-1338 | 1 Oct 201520:59 | – | nvd |
 | Ubuntu: Security Advisory (USN-2744-1) | 25 Sep 201500:00 | – | openvas |
| SUSE: Security Advisory (SUSE-SU-2017:1938-1) | 9 Jun 202100:00 | – | openvas |
 | SUSE-SU-2017:1938-1 Security update for apport | 24 Jul 201713:37 | – | osv |
| UBUNTU-CVE-2015-1338 | 24 Sep 201500:00 | – | osv |
| USN-2744-1 apport vulnerability | 24 Sep 201511:58 | – | osv |
10
Source: http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/
Problem description: On Ubuntu Vivid Linux distribution apport is used for automated sending of client program crash dumps but also of kernel crash dumps. For kernel crashes, upstart or SysV init invokes the program /usr/share/apport/kernel_crashdump at boot to prepare crash dump files for sending. This action is performed with root privileges. As the crash dump directory /var/crash/ is world writable and kernel_crashdump performs file access in unsafe manner, any local user may trigger a denial of service or escalate to root privileges. If symlink and hardlink protection is enabled (which should be the default for any modern system), only denial of service is possible.
Problematic syscall in kernel_crashdump is:
open("/var/crash/linux-image-3.19.0-18-generic.0.crash", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE|O_CLOEXEC, 0666) = 30
...
open("/var/crash/vmcore.log", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 31
Thus the output file is opened unconditionally and without O_EXCL or O_NOFOLLOW. Also opening of input file does not care about links.
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38353.zip
# 0day.today [2018-02-19] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Sep 2015 00:00Current
6.3Medium risk
Vulners AI Score6.3
EPSS0.00379