PT-2011-4274 · Canonical · Ubuntu Software Center

David B · Published 2011-11-29 · Updated 2017-08-29 · CVE-2011-3150

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ubuntu Software Center versions 11.10, 11.04, 10.10

Description The issue allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle (MITM) attack, due to improper validation of server certificates.

Recommendations For Ubuntu Software Center version 11.10, update the certificate validation mechanism to properly verify server certificates. For Ubuntu Software Center version 11.04, update the certificate validation mechanism to properly verify server certificates. For Ubuntu Software Center version 10.10, update the certificate validation mechanism to properly verify server certificates.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-3150

Affected Products

Ubuntu Software Center

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-3150 · Security Note
• http://secunia.com/advisories/46950 · Vendor Advisory
• http://ubuntu.com/usn/USN-1270-1 · Vendor Advisory
• http://securityfocus.com/bid/50754 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71430 · Note