PT-2012-2968 · Canonical · Update Manager

Publicado 2012-06-07 · Atualizado 2017-08-29 · CVE-2012-0948

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Update Manager versions used by Ubuntu 12.04 LTS, 11.10, and 11.04

Description The issue concerns weak permissions used by Update Manager in Ubuntu for certain files, specifically apt-clone system state.tar.gz and system state.tar.gz. This weakness allows local users to obtain repository credentials.

Recommendations For Ubuntu 12.04 LTS, 11.10, and 11.04, consider restricting access to the apt-clone system state.tar.gz and system state.tar.gz files until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-0948

Produtos afetados

Update Manager

Referências · 7

• http://ubuntu.com/usn/USN-1443-1 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75727 · Nota
• http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gz · Nota
• http://securityfocus.com/bid/53604 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0948 · Nota de Segurança
• http://secunia.com/advisories/49230 · Aviso do Fabricante
• http://osvdb.org/82019 · Nota