title: Apport reads arbitrary files if ~/.config/apport/settings is a symlink
description: Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.
problem types: Read user data with administrator privileges
affected:
{
vendor: Canonical
product: apport
versions:
version: 2.14.1, status: affected, lessThan: 2.14.1-0ubuntu3.29+esm2, versionType: custom
version: 2.20.1, status: affected, lessThan: 2.20.1-0ubuntu2.20, versionType: custom
version: 2.20.9, status: affected, lessThan: 2.20.9-0ubuntu7.8, versionType: custom
version: 2.20.11, status: affected, lessThan: 2.20.11-0ubuntu8.1, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
]