==========================================================================
Ubuntu Security Notice USN-2609-1
May 21, 2015

apport vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 15.04
– Ubuntu 14.10
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS

Summary:

Apport could be tricked into creating arbitrary files as an administrator,
resulting in privilege escalation.

Software Description:
– apport: automatically generate crash reports for debugging

Details:

Sander Bos discovered that Apport incorrectly handled permissions when
the system was configured to generate core dumps for setuid binaries. A
local attacker could use this issue to gain elevated privileges.
(CVE-2015-1324)

Philip Pettersson discovered that Apport contained race conditions
resulting core dumps to be generated with incorrect permissions in
arbitrary locations. A local attacker could use this issue to gain elevated
privileges. (CVE-2015-1325)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
apport 2.17.2-0ubuntu1.1

Ubuntu 14.10:
apport 2.14.7-0ubuntu8.5

Ubuntu 14.04 LTS:
apport 2.14.1-0ubuntu3.11

Ubuntu 12.04 LTS:
apport 2.0.1-0ubuntu17.9

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2609-1
CVE-2015-1324, CVE-2015-1325

Package Information:
https://launchpad.net/ubuntu/+source/apport/2.17.2-0ubuntu1.1
https://launchpad.net/ubuntu/+source/apport/2.14.7-0ubuntu8.5
https://launchpad.net/ubuntu/+source/apport/2.14.1-0ubuntu3.11
https://launchpad.net/ubuntu/+source/apport/2.0.1-0ubuntu17.9

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJVXhN+AAoJEGVp2FWnRL6TSo0QAIWxMmVaB45P6PzglXsn4+DT
cWro/1BKetDS2esCSyOBaQGv9YiePJyaC6op6iNSEBUV1jYux5wFRFDcdkmw/kDZ
1j6/VzTknQz8hSXCMUDoDKxIA9RD+nU2WvByXFc1RL98siGehnDLEJGup3QSOAxh
mzij40FUYBdgCDrdsAJvucQcxtlwiJ3zjQI82OB1PVwHkASIbKT8YEwnkyTrEm+r
KdMEZ0lPpJD3M5AIctuFDb7wcRtUZkSXE3OtW6InhNNlCPju1NwUn24ZmtW2Rf3l
0B6jI3Df0Ilu1cmgDv31SWI3xqAKZyrxz/zWu6SURGM6nq9mZq7Ry7VueP68XjFW
FHUKEogV76Am9B8FVLEmRlW8JiRqI/cr0l14caCFPtgne0eA4RIKfFePoKxAb4UE
TU/NkORn0Q5Mb+34/gGEAvgPmQNGJQcZYzO/Fs4cwajG5xeGXq+/Qyw5fA3/D9Fx
966qKSlqlOsRGpuD+ZEHYuC7RH8mEBrfiPvz9e+e+Kp6UwOvqnpKUV2bx2hKmoJK
1gVThukdQNp09FQOZGS5qYb/xr05t9hMMi5E9e9AJ82f8XTC+II4Nnt/tLVtL0zo
9HpGTekoxDdWYrK/kv52bLBDLXgIlcaHCDBPjfTgrKLfGAT6ZQLZzJkStwbsTc1u
yFQMNOgXgUWWhis058Ag
=GJVS
—–END PGP SIGNATURE—–
—