CVE-2016-9950

Apport is the built-in tool that helps Ubuntu collect information when programs crash. This bug lets someone “sneak” special file-path values into a crash report so Apport looks in the wrong place and ends up running a malicious script instead of the expected hook. Think of it like a smoke-alarm that reads a label from the box to decide what to open—if the label is tampered with, the alarm can be made to open the wrong (harmful) item.

This matters if you run Ubuntu systems with Apport installed and a local attacker can influence where Apport reads crash files (for example, an untrusted user account on the same machine). In a typical small business, the risk is mainly from someone with local access—not from random internet users.
The practical reachability gate is: only a risk if the attacker can place crafted crash files in the location Apport will process (and Apport is before 2.20.4).

This is an Amber issue because a public proof-of-concept exists and the scenario is realistically reachable for machines where an attacker can place files locally. However, there’s no confirmed CISA KEV listing in the findings, so the most important condition is whether someone can get local access and drop crafted crash files.
Act on it promptly, especially on shared servers, workstations with multiple users, or any system where untrusted users can write crash-report files.

Confirm exposure

• Identify whether Apport is installed and determine the version.
• Check that your Apport version is before 2.20.4.

Upgrade to the fix

• Upgrade Apport to 2.20.4 or newer (the issue is specifically described as present “before 2.20.4”).
• Use your normal Ubuntu update process so you land on the distro’s fixed package build for Apport 2.20.4.
• Reference fix details: Launchpad bug 1648806 (as provided in the findings).

What to check on the machine (reachability)

• Determine who can write into any crash-report locations Apport uses.
• If untrusted users can create or influence crash files (for example, multiple local users, kiosk-style browsing, shared lab machines, or compromised user accounts), treat this as higher risk.

Temporary workaround (if patching is delayed)

• Reduce the chance that an attacker can place crafted crash files by tightening local access controls:
  • Ensure only trusted users can create/modify files in relevant crash-report directories.
  • Remove unnecessary local accounts and restrict write permissions.
  • If you can, isolate/lock down systems where you suspect an untrusted user presence until you patch.

After upgrading

• Re-check the Apport version to ensure it’s 2.20.4+.
• Verify that crash reporting still works for legitimate crashes (basic smoke test).

What to monitor

• Look for unusual local activity around crash-report generation and any errors in Apport after updates.
• If you already suspect compromise, investigate for unexpected Python execution by untrusted users.

Severity is HIGH (CVSS 7.8) and the weakness is CWE-22 (Path Traversal). The mechanism is: Apport reads “Package” and “SourcePackage” fields from a crash report, uses them to construct paths to package-specific hook files under /usr/share/apport/package-hooks/, and a path traversal allows the attacker to reach and execute arbitrary Python files.

Exploitation status: the findings report a public proof-of-concept on GitHub (3 known), with rising press attention and a rising predicted likelihood; however, there is no CISA KEV listing in the provided findings. Attack conditions require an attacker to place crafted crash files in the target location, and user interaction is required (per the findings), with no authentication required (per the findings), meaning the key barrier is the ability to manipulate local crash report inputs.

EPSS is reported as 6.5% with a rising trend, but since KEV/news exploitation is not confirmed in the findings, the EPSS is informational rather than proof of active exploitation.