Bugzilla – Bug 847835
VUL-0: CVE-2013-1067: apport: incorrect permissions for setuid core dumps
Last modified: 2013-12-20 15:12:47 UTC
Martin Carpenter discovered that Apport set incorrect permissions on core
dump files generated by setuid binaries. A local attacker could possibly
use this issue to obtain privileged information.
(we also have a old version of apport ... do we want it on the distribution still or should we get rid of it?)
bugbot adjusting priority
ISTM that on SUSE, /proc/sys/fs/suid_dumpable is 0 by default, and that should mean that setuid programs don't generate crash dumps at all.
Can you confirm?
If this is the case, we are unaffected by the bug.
(we might want to fix this anyway, for users who switch fs.suid_dumpable to a non-zero value. but that would probably make this a lower-priority fix)
i am totally fine with fixing this just for Factory/SLE12 as you said we do not default enable core dumps nor apport.
we got an apport update heading to Factory, so i am closing this