CVE-2017-14179

Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://launchpad.net/bugs/1726372	Issue Tracking Third Party Advisory
https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179	Third Party Advisory
https://launchpad.net/bugs/1726372	Issue Tracking Third Party Advisory
https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apport_project:apport:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:17.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:17.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::

History

21 Nov 2024, 03:12

Type	Values Removed	Values Added
References	~~() https://launchpad.net/bugs/1726372 - Issue Tracking, Third Party Advisory~~	() https://launchpad.net/bugs/1726372 - Issue Tracking, Third Party Advisory
References	~~() https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179 - Third Party Advisory~~	() https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179 - Third Party Advisory

Information

Published : 2018-02-02 14:29

Updated : 2024-11-21 03:12

NVD link : CVE-2017-14179

Mitre link : CVE-2017-14179

CVE.ORG link : CVE-2017-14179

JSON object : View

Products Affected

canonical

ubuntu_linux

apport_project

apport

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2017-14179", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-02-02T14:29:00.403", "references": [{"url": "https://launchpad.net/bugs/1726372", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://launchpad.net/bugs/1726372", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers."}, {"lang": "es", "value": "Apport, en versiones anteriores a la 2.13, no gestiona adecuadamente los cierres inesperados provenientes de un espacio de nombre PID, lo que permite que los usuarios locales creen ciertos archivos como root. Un atacante podr\u00eda aprovechar estos archivos para realizar una denegaci\u00f3n de servicio (DoS) mediante el agotamiento de recursos o, posiblemente, obtener privilegios root o escapar de contenedores."}], "lastModified": "2024-11-21T03:12:18.607", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apport_project:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "346D6903-A9B3-491B-8C4F-0506F18E7EAD", "versionEndExcluding": "2.13"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "588D4F37-0A56-47A4-B710-4D5F3D214FB9"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}