Published: 01/10/2015 Updated: 02/10/2015

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 725

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

kernel_crashdump in Apport prior to 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apport project apport
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
canonical ubuntu linux 15.04

Apport could be made to crash or overwrite files as an administrator ...

Source: wwwhalfdognet/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/ Problem description: On Ubuntu Vivid Linux distribution apport is used for automated sending of client program crash dumps but also of kernel crash dumps For kernel crashes, upstart or SysV init invokes the program /usr/share/apport/kernel_crashdump at bo ...

CWE-59 http://www.ubuntu.com/usn/USN-2744-1 https://launchpad.net/apport/trunk/2.19 https://www.exploit-db.com/exploits/38353/http://seclists.org/fulldisclosure/2015/Sep/101 http://packetstormsecurity.com/files/133723/Ubuntu-Apport-kernel_crashdump-Symlink.html http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1492570 https://usn.ubuntu.com/2744-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/38353/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-1338

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect