CVE-2019-11481

What it actually does

Apport, executing with root privileges, resolves and reads a user-controlled configuration file path that an attacker can replace with a symbolic link, enabling arbitrary file reads from the filesystem as root.

Why it matters to the business

Attackers with local access can disclose sensitive system files such as passwords, keys, or configuration data, potentially enabling further attacks or data breaches on Ubuntu systems running the vulnerable Apport package.

How an attack unfolds

A local attacker prepares a symbolic link pointing to a privileged file in the location Apport expects for its configuration, then invokes Apport (via crash reporting or direct execution) so that the elevated-privilege process dereferences the link and leaks the target file contents.

How to fix it

Upgrade Apport to a patched release that validates configuration paths and refuses to follow symbolic links when operating with elevated privileges; apply the fix through standard Ubuntu package management channels as soon as available.

How to confirm the fix worked

Confirm the updated Apport binary refuses to follow symlinks for user-supplied configuration paths when executed under root or setuid contexts, and verify package version matches the distributor's fixed release.

Typical attack path

1. Identify expected Apport configuration file path
2. Replace path with symbolic link to desired target file
3. Trigger Apport execution under elevated privileges
4. Capture output or side-channel leakage of arbitrary file contents

How to detect it

Review system logs and Apport execution traces for the process opening files via unexpected symbolic links; inspect /var/log/apport.log or auditd records for anomalous read operations on sensitive paths during apport execution.

• /var/crash
• apport.*symlink
• readlink.*apport
• apport.*config.*->

What your security team should do

• Prioritize patching Apport across all Ubuntu deployments
• Restrict local user accounts that can invoke Apport
• Audit Apport-related file access logs for unexpected symlink usage
• Harden crash reporting workflows to limit privileged reads