Apport Local Arbitrary File Deletion Vulnerability

Bugtraq ID:	34776
Class:	Unknown
CVE:	CVE-2009-1295
Remote:	No
Local:	Yes
Published:	Apr 29 2009 12:00AM
Updated:	May 12 2009 10:06PM
Credit:	Stephane Chazelas
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 S.u.S.E. openSUSE 11.1
Not Vulnerable:

Apport Local Arbitrary File Deletion Vulnerability

Apport deletes crash-report files in an unsafe manner.

A local attacker may exploit this issue to delete arbitrary files, resulting in a denial-of-service condition. Other attacks may also be possible.

Apport Local Arbitrary File Deletion Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apport Local Arbitrary File Deletion Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu apport-gtk_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.108. 4_all.deb


• Ubuntu apport-qt_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.108.4 _all.deb


• Ubuntu apport-retrace_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 108.4_all.deb


• Ubuntu apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.108.4_al l.deb


• Ubuntu python-apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 08.4_all.deb


• Ubuntu python-problem-report_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.108.4_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu apport-gtk_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.119. 2_all.deb


• Ubuntu apport-qt_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.119.2 _all.deb


• Ubuntu apport-retrace_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 119.2_all.deb


• Ubuntu apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.119.2_al l.deb


• Ubuntu python-apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 19.2_all.deb


• Ubuntu python-problem-report_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.119.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu apport-gtk_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.108. 4_all.deb


• Ubuntu apport-qt_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.108.4 _all.deb


• Ubuntu apport-retrace_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 108.4_all.deb


• Ubuntu apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.108.4_al l.deb


• Ubuntu python-apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 08.4_all.deb


• Ubuntu python-problem-report_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.108.4_all.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu apport-gtk_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_1.0-0u buntu5.2_all.deb


• Ubuntu apport-qt_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_1.0-0ub untu5.2_all.deb


• Ubuntu apport-retrace_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_1. 0-0ubuntu5.2_all.deb


• Ubuntu apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_1.0-0ubunt u5.2_all.deb


• Ubuntu python-apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_1.0 -0ubuntu5.2_all.deb


• Ubuntu python-problem-report_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_1.0-0ubuntu5.2_all.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu apport-gtk_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_1.0-0u buntu5.2_all.deb


• Ubuntu apport-qt_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_1.0-0ub untu5.2_all.deb


• Ubuntu apport-retrace_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_1. 0-0ubuntu5.2_all.deb


• Ubuntu apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_1.0-0ubunt u5.2_all.deb


• Ubuntu python-apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_1.0 -0ubuntu5.2_all.deb


• Ubuntu python-problem-report_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_1.0-0ubuntu5.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu apport-gtk_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.108. 4_all.deb


• Ubuntu apport-qt_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.108.4 _all.deb


• Ubuntu apport-retrace_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 108.4_all.deb


• Ubuntu apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.108.4_al l.deb


• Ubuntu python-apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 08.4_all.deb


• Ubuntu python-problem-report_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.108.4_all.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu apport-gtk_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_1.0-0u buntu5.2_all.deb


• Ubuntu apport-qt_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_1.0-0ub untu5.2_all.deb


• Ubuntu apport-retrace_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_1. 0-0ubuntu5.2_all.deb


• Ubuntu apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_1.0-0ubunt u5.2_all.deb


• Ubuntu python-apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_1.0 -0ubuntu5.2_all.deb


• Ubuntu python-problem-report_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_1.0-0ubuntu5.2_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu apport-gtk_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.119. 2_all.deb


• Ubuntu apport-qt_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.119.2 _all.deb


• Ubuntu apport-retrace_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 119.2_all.deb


• Ubuntu apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.119.2_al l.deb


• Ubuntu python-apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 19.2_all.deb


• Ubuntu python-problem-report_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.119.2_all.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu apport-gtk_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_1.0-0u buntu5.2_all.deb


• Ubuntu apport-qt_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_1.0-0ub untu5.2_all.deb


• Ubuntu apport-retrace_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_1. 0-0ubuntu5.2_all.deb


• Ubuntu apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_1.0-0ubunt u5.2_all.deb


• Ubuntu python-apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_1.0 -0ubuntu5.2_all.deb


• Ubuntu python-problem-report_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_1.0-0ubuntu5.2_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu apport-gtk_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.119. 2_all.deb


• Ubuntu apport-qt_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.119.2 _all.deb


• Ubuntu apport-retrace_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 119.2_all.deb


• Ubuntu apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.119.2_al l.deb


• Ubuntu python-apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 19.2_all.deb


• Ubuntu python-problem-report_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.119.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu apport-gtk_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.108. 4_all.deb


• Ubuntu apport-qt_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.108.4 _all.deb


• Ubuntu apport-retrace_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 108.4_all.deb


• Ubuntu apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.108.4_al l.deb


• Ubuntu python-apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 08.4_all.deb


• Ubuntu python-problem-report_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.108.4_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu apport-gtk_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.119. 2_all.deb


• Ubuntu apport-qt_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.119.2 _all.deb


• Ubuntu apport-retrace_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 119.2_all.deb


• Ubuntu apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.119.2_al l.deb


• Ubuntu python-apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 19.2_all.deb


• Ubuntu python-problem-report_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.119.2_all.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu apport-gtk_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.119. 2_all.deb


• Ubuntu apport-qt_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.119.2 _all.deb


• Ubuntu apport-retrace_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 119.2_all.deb


• Ubuntu apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.119.2_al l.deb


• Ubuntu python-apport_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 19.2_all.deb


• Ubuntu python-problem-report_0.119.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.119.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu apport-gtk_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_0.108. 4_all.deb


• Ubuntu apport-qt_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_0.108.4 _all.deb


• Ubuntu apport-retrace_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_0. 108.4_all.deb


• Ubuntu apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_0.108.4_al l.deb


• Ubuntu python-apport_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_0.1 08.4_all.deb


• Ubuntu python-problem-report_0.108.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_0.108.4_all.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu apport-gtk_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-gtk_1.0-0u buntu5.2_all.deb


• Ubuntu apport-qt_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-qt_1.0-0ub untu5.2_all.deb


• Ubuntu apport-retrace_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport-retrace_1. 0-0ubuntu5.2_all.deb


• Ubuntu apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/apport_1.0-0ubunt u5.2_all.deb


• Ubuntu python-apport_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-apport_1.0 -0ubuntu5.2_all.deb


• Ubuntu python-problem-report_1.0-0ubuntu5.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apport/python-problem-re port_1.0-0ubuntu5.2_all.deb

Apport Local Arbitrary File Deletion Vulnerability

References:

• Apport Homepage (Ubuntu)