CVE-2016-9949

What it actually does

The vulnerability allows arbitrary Python code execution when Apport processes a crash report containing a CrashDB field that begins with '{' by directly evaluating the field contents as Python code in apport/ui.py.

Why it matters to the business

Attackers can gain full control over affected systems to steal data, install persistent malware, or disrupt operations; the issue has been publicly known for nearly a decade with working exploits available, though widespread impact is limited to systems still running the unpatched error-reporting component.

How an attack unfolds

An attacker prepares a specially crafted crash report file or input that includes a CrashDB value starting with '{' followed by malicious Python statements. When the report is processed on a vulnerable system, Apport evaluates the field as executable code, resulting in arbitrary command execution under the privileges of the Apport process.

How to fix it

Upgrade Apport to version 2.20.4 or later on all affected Ubuntu and Apport installations to eliminate the unsafe evaluation of the CrashDB field.

How to confirm the fix worked

Confirm the installed Apport version is 2.20.4 or newer; test by submitting a benign crash report containing a non-executable CrashDB value and verify that no code evaluation occurs.

Typical attack path

1. Craft a malicious crash report containing a CrashDB field prefixed with '{' and arbitrary Python code.
2. Deliver the report to the target via local file placement, user interaction, or automated crash submission paths.
3. Trigger Apport to process the report through normal error-handling workflows.
4. Apport evaluates the CrashDB field as Python, executing the attacker-supplied code.
5. Attacker achieves code execution and proceeds with further actions such as persistence or data exfiltration.

How to detect it

Review system and application logs for unexpected Python code execution or unusual process spawns originating from Apport; examine any crash report files present on disk for fields beginning with '{' that contain executable statements.

What your security team should do

• Immediately inventory all systems running Apport and prioritize patching those still on versions before 2.20.4.
• Disable or restrict Apport crash reporting on high-value systems until patches are applied.
• Monitor for any remaining unpatched instances given the public exploit availability and long disclosure window.