PT-2012-5951 · Canonical · Ubuntu Software Properties

Marc Deslauriers · Publicado 2012-10-10 · Atualizado 2017-08-29 · CVE-2012-5356

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ubuntu Software Properties versions 0.75.x through 0.75.9, Ubuntu Software Properties versions 0.80.x through 0.80.9.1, Ubuntu Software Properties versions 0.81.x through 0.81.13.4, Ubuntu Software Properties versions 0.82.x through 0.82.7.2, Ubuntu Software Properties versions 0.92.x through 0.92.7

Description The issue allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack, due to the apt-add-repository tool not properly checking PPA GPG keys imported from a keyserver.

Recommendations For Ubuntu Software Properties version 0.75.x, update to version 0.75.10.3 or later. For Ubuntu Software Properties version 0.80.x, update to version 0.80.9.2 or later. For Ubuntu Software Properties version 0.81.x, update to version 0.81.13.5 or later. For Ubuntu Software Properties version 0.82.x, update to version 0.82.7.3 or later. For Ubuntu Software Properties version 0.92.x, update to version 0.92.8 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-5356

Produtos afetados

Ubuntu Software Properties

Referências · 5

• http://securityfocus.com/bid/55736 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5356 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78990 · Nota
• http://ubuntu.com/usn/USN-1588-1 · Aviso do Fabricante
• https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1016643 · Nota