Vulnerability Name:

CVE-2015-1338 (CCN-106881)

Assigned:2015-09-26
Published:2015-09-26
Updated:2015-10-02
Summary:kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
CVSS v3 Severity:8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.6 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-59
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2015-1338

Source: MISC
Type: Exploit
http://packetstormsecurity.com/files/133723/Ubuntu-Apport-kernel_crashdump-Symlink.html

Source: FULLDISC
Type: UNKNOWN
20150927 Apport kernel_crashdump symlink vulnerability exploitation

Source: MISC
Type: Exploit
http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/

Source: UBUNTU
Type: UNKNOWN
USN-2744-1

Source: CONFIRM
Type: UNKNOWN
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1492570

Source: XF
Type: UNKNOWN
apport-cve20151338-priv-esc(106881)

Source: CONFIRM
Type: Patch
https://launchpad.net/apport/trunk/2.19

Source: CCN
Type: Packet Storm Security [09-26-2015]
Ubuntu Apport kernel_crashdump Symlink

Source: CCN
Type: Ubuntu Wiki Web site
Apport - Ubuntu Wiki

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [09-29-2015]

Source: EXPLOIT-DB
Type: Exploit
38353

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apport_project:apport:*:*:*:*:*:*:*:* (Version <= 2.18.1)

    • Configuration 2:
  • cpe:/o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:ubuntu:ubuntu:14.04:*:*:*:lts:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20151338
    V
    		CVE-2015-1338
    2022-05-20
    oval:org.opensuse.security:def:32225
    P
    		Security update for postgresql10 (Important)
    2021-11-22
    oval:org.opensuse.security:def:34566
    P
    		Security update for strongswan (Important)
    2021-10-19
    oval:org.opensuse.security:def:33980
    P
    		Security update for sqlite3 (Important)
    2021-09-23
    oval:org.opensuse.security:def:32149
    P
    		Security update for linuxptp (Important)
    2021-07-21
    oval:org.opensuse.security:def:32965
    P
    		Security update for the Linux Kernel (Important)
    2021-07-20
    oval:org.opensuse.security:def:32137
    P
    		Security update for libsolv (Important)
    2021-06-28
    oval:org.opensuse.security:def:33676
    P
    		Security update for xterm (Important)
    2021-06-18
    oval:org.opensuse.security:def:33922
    P
    		Security update for libX11 (Important)
    2021-06-08
    oval:org.opensuse.security:def:30088
    P
    		Security update for spice (Important)
    2021-06-08
    oval:org.opensuse.security:def:34430
    P
    		Security update for xen (Important)
    2021-05-12
    oval:org.opensuse.security:def:33642
    P
    		Security update for java-1_7_0-openjdk (Moderate)
    2021-04-29
    oval:org.opensuse.security:def:32898
    P
    		Security update for qemu (Important)
    2021-04-16
    oval:org.opensuse.security:def:31140
    P
    		Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:34665
    P
    		Security update for ovmf (Moderate)
    2021-03-30
    oval:org.opensuse.security:def:30044
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP2) (Important)
    2021-03-17
    oval:org.opensuse.security:def:34029
    P
    		Security update for java-1_8_0-ibm (Important)
    2021-02-26
    oval:org.opensuse.security:def:30025
    P
    		Security update for screen (Important)
    2021-02-17
    oval:org.opensuse.security:def:33765
    P
    		Security update for jasper (Important)
    2021-02-16
    oval:org.opensuse.security:def:32921
    P
    		Security update for dnsmasq (Important)
    2021-01-19
    oval:org.opensuse.security:def:32138
    P
    		Security update for openssh (Moderate)
    2021-01-05
    oval:org.opensuse.security:def:28916
    P
    		Security update for flac (Moderate)
    2021-01-04
    oval:org.opensuse.security:def:29368
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:28872
    P
    		Security update for MozillaFirefox (Critical)
    2020-12-21
    oval:org.opensuse.security:def:31096
    P
    		Security update for python (Important)
    2020-12-11
    oval:org.opensuse.security:def:34334
    P
    		Security update for python (Important)
    2020-12-11
    oval:org.opensuse.security:def:33619
    P
    		Security update for mutt (Important)
    2020-12-07
    oval:org.opensuse.security:def:35868
    P
    		ark-4.3.5-0.3.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35827
    P
    		syslog-ng-2.0.9-27.32.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:28855
    P
    		Security update for python-setuptools (Important)
    2020-12-02
    oval:org.opensuse.security:def:29297
    P
    		Security update for python-setuptools (Important)
    2020-12-02
    oval:org.opensuse.security:def:33307
    P
    		zoo on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28713
    P
    		Security update for Java OpenJDK
    2020-12-01
    oval:org.opensuse.security:def:34722
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30324
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32359
    P
    		Security update for strongswan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35030
    P
    		Security update for hplip
    2020-12-01
    oval:org.opensuse.security:def:30763
    P
    		Security update for apport (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30410
    P
    		Security update for xorg-x11-libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29554
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:32597
    P
    		puppet on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35145
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:28128
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30689
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:34068
    P
    		Security update for libxml2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29586
    P
    		Security update for apache2-mod_nss (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32859
    P
    		file-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28335
    P
    		Security update for php53 (Important)
    2020-12-01
    oval:org.opensuse.security:def:30987
    P
    		Security update for ipsec-tools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34775
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:34346
    P
    		Security update for squid3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29882
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:33296
    P
    		xorg-x11-libXfixes-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28561
    P
    		Security update for icedtea-web
    2020-12-01
    oval:org.opensuse.security:def:33523
    P
    		Security update for systemtap
    2020-12-01
    oval:org.opensuse.security:def:28816
    P
    		Security update for pwlib
    2020-12-01
    oval:org.opensuse.security:def:31816
    P
    		Security update for apport (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34971
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30726
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:30336
    P
    		Security update for tomcat6 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29286
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:32510
    P
    		file-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35118
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:28127
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30632
    P
    		Security update for Xen
    2020-12-01
    oval:org.opensuse.security:def:29499
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32810
    P
    		xorg-x11-libs-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28205
    P
    		Security update for libksba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30931
    P
    		Security update for ghostscript-library (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34137
    P
    		Security update for ntp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34335
    P
    		Security update for sqlite3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29729
    P
    		Security update for Mozilla Firefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:33295
    P
    		xorg-x11-libXext-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28477
    P
    		Security update for yast2-storage (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31075
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:29986
    P
    		Security update for libssh2_org (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33388
    P
    		Security update for compat-openssl097g (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28767
    P
    		Security update for libsndfile (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31778
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:34812
    P
    		Security update for apache2-mod_perl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30325
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29285
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:32453
    P
    		Security update for xfsprogs (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35079
    P
    		Security update for java-1_7_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:30542
    P
    		Security update for kdelibs4
    2020-12-01
    oval:org.opensuse.security:def:29590
    P
    		Security update for apport (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32753
    P
    		nagios-plugins on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35189
    P
    		Security update for kvm and libvirt
    2020-12-01
    oval:org.opensuse.security:def:28139
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:30776
    P
    		Security update for axis (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34093
    P
    		Security update for microcode_ctl (Important)
    2020-12-01
    oval:org.opensuse.security:def:29643
    P
    		Security update for cups (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28420
    P
    		Security update for tiff (Low)
    2020-12-01
    oval:org.opensuse.security:def:31036
    P
    		Security update for kdebase4-workspace
    2020-12-01
    oval:org.opensuse.security:def:34815
    P
    		Security update for apport (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29937
    P
    		Security update for libjasper
    2020-12-01
    oval:org.opensuse.security:def:33603
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:com.ubuntu.precise:def:20151338000
    V
    		CVE-2015-1338 on Ubuntu 12.04 LTS (precise) - medium.
    2015-10-01
    oval:com.ubuntu.xenial:def:201513380000000
    V
    		CVE-2015-1338 on Ubuntu 16.04 LTS (xenial) - medium.
    2015-10-01
    oval:com.ubuntu.trusty:def:20151338000
    V
    		CVE-2015-1338 on Ubuntu 14.04 LTS (trusty) - medium.
    2015-10-01
    oval:com.ubuntu.xenial:def:20151338000
    V
    		CVE-2015-1338 on Ubuntu 16.04 LTS (xenial) - medium.
    2015-10-01
    BACK
    apport_project apport *
    canonical ubuntu linux 12.04
    canonical ubuntu linux 14.04
    canonical ubuntu linux 15.04
    ubuntu ubuntu 14.04