PT-2010-2558 · Canonical · Base-Files

Published 2010-08-09 · Updated 2010-08-10 · CVE-2010-0834

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions base-files versions prior to 5.0.0ubuntu7.1 on Ubuntu 9.10 base-files versions prior to 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS

Description The issue allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package, as the base-files package does not require authentication for package installation.

Recommendations For base-files versions prior to 5.0.0ubuntu7.1 on Ubuntu 9.10, update to version 5.0.0ubuntu7.1 or later. For base-files versions prior to 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, update to version 5.0.0ubuntu20.10.04.2 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-0834

Affected Products

Base-Files

References · 5

• http://secunia.com/advisories/40889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0834 · Security Note
• http://ubuntu.com/usn/usn-968-1 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2015 · Vendor Advisory
• http://securityfocus.com/bid/42280 · Patch