CVE-2019-11481 Apport reads arbitrary files if ~/.config/apport/settings is a symlink
A local attacker can exploit a symlink vulnerability in Apport to read arbitrary files on the system with root privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11481?
CVE-2019-11481 is a low-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 8 Feb 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.
Weakness: CWE-59
Which versions are affected by CVE-2019-11481?
It affects 2 products.
Products include Apport Project Apport, Canonical Ubuntu Linux.
How do I fix CVE-2019-11481?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-11481 being exploited?
There is no known exploitation of CVE-2019-11481 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as GHSA-7hrm-rprg-v656, UBUNTU-CVE-2019-11481.