CVE-2015-1341

What it actually does

Apport's crash handling logic inspects a Python process command line containing -m and then imports an arbitrary module from sys.path as the root user, allowing local attackers to execute code with elevated privileges.

Why it matters to the business

Attackers on the same machine can gain full administrative control, leading to data theft, persistence, or ransomware deployment; the issue affects many Ubuntu systems but has seen no widespread exploitation.

How an attack unfolds

An attacker places a malicious Python module in a directory that appears in sys.path, runs a Python program via python -m to trigger a crash, and Apport's handler imports the attacker-controlled module while running with root privileges.

How to fix it

Upgrade Apport to version 2.19.2 or later on all affected Ubuntu releases; apply the latest package updates from Canonical that contain the corrected crash-handling logic.

How to confirm the fix worked

Confirm the installed Apport package version is at least 2.19.2, review Apport source for the fixed _python_module_path function, and test that python -m invocations no longer allow arbitrary imports during crash handling.

Typical attack path

1. Create a malicious Python module in a writable directory on sys.path.
2. Execute a Python process with the -m flag to trigger a core dump.
3. Wait for Apport to process the crash and import the planted module.
4. Obtain root-level code execution from the imported module.

How to detect it

Inspect system logs for Apport invocations involving python -m command lines, look for unexpected Python module imports or file creations in sys.path directories around crash events, and review process trees where apport runs immediately after a python process.

What your security team should do

• Prioritize patching Apport on all Ubuntu systems within standard maintenance windows.
• Monitor package repositories for backported fixes on older Ubuntu releases.
• Restrict untrusted users from writing to directories in Python sys.path used by system processes.
• Review logs for unexpected Python imports during Apport crash handling.