Bugzilla – Bug 1049352
VUL-0: CVE-2017-10708: apport: Remote code execution via crafted .crash file
Last modified: 2017-11-17 15:35:29 UTC
CVE-2017-10708 An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific hooks without protecting against path traversal. This allows remote attackers to execute arbitrary code via a crafted .crash file. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-10708 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-10708.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10708 https://launchpad.net/bugs/1700573 https://launchpad.net/ubuntu/+source/apport/+changelog
does this affect us, seeing comment 7 here? http://bugzilla.suse.com/show_bug.cgi?id=947731#c7 quote relevant part: > It turns out that the whole exploit is based on /var/crash > being world writable. While this seemed to be the case on Ubuntu back then, > it is not the case in our SLE-11 distributions.
ok thank you!