Cloudanix VulnDB

CVE-2017-10708

High · 7.8

CVSS

7.8

EPSS

2.1%

Published

Jul 18, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in crash reporting software lets attackers run their own programs simply by sending a specially made crash report file that tricks the system into executing malicious code.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Full Compromise
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Path traversal in apport/report.py allows the ExecutablePath field from a .crash file to be used directly when invoking package-specific hooks, enabling execution of arbitrary code outside intended directories.

Why it matters to the business

Attackers can gain code execution on systems processing untrusted crash reports, potentially leading to full system compromise, data theft, or persistence in environments that rely on Apport for crash handling.

How an attack unfolds

An attacker crafts a malicious .crash file embedding a path traversal sequence in the ExecutablePath field that points to attacker-controlled hook code; the victim or automated system opens or processes the file, causing Apport to execute the malicious payload without sanitization.

How to fix it

Upgrade Apport to a version that validates and sanitizes the ExecutablePath field before hook execution; restrict processing of .crash files from untrusted sources and apply vendor patches when available.

How to confirm the fix worked

Verify the installed Apport version against known fixed releases, review source for path sanitization in report.py, and test by submitting a crafted .crash file containing traversal sequences to confirm execution is blocked.

Typical attack path

  1. Craft a .crash file containing a malicious ExecutablePath with traversal sequences
  2. Deliver the file to the target via email, download, or shared storage
  3. Trick the user or automated process into opening or submitting the file to Apport
  4. Apport reads the field and invokes attacker-supplied hooks, executing arbitrary code

How to detect it

Search system and application logs for Apport hook invocations referencing paths with traversal sequences; inspect recently processed .crash files for anomalous ExecutablePath values; review user-submitted crash reports for unexpected executable locations.

  • ../
  • ..\
  • ExecutablePath=.*\.\./
  • hook.*exec.*crash

What your security team should do

  • Immediately upgrade Apport to the latest available version on all affected systems
  • Disable automatic processing of external .crash files until patched
  • Implement file-type restrictions and sandboxing for crash report handling
  • Monitor for and block suspicious .crash files containing path traversal patterns

The record

An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific hooks without protecting against path traversal. This allows remote attackers to execute arbitrary code via a crafted .crash file.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS apport 0 2.14.1-0ubuntu3.25
Ubuntu:16.04:LTS apport 0 2.20.1-0ubuntu2.10

Related vulnerabilities