PT-2012-2968 · Canonical · Update Manager

Published 2012-06-07 · Updated 2017-08-29 · CVE-2012-0948

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Update Manager versions used by Ubuntu 12.04 LTS, 11.10, and 11.04

Description The issue concerns weak permissions used by Update Manager in Ubuntu for certain files, specifically apt-clone system state.tar.gz and system state.tar.gz. This weakness allows local users to obtain repository credentials.

Recommendations For Ubuntu 12.04 LTS, 11.10, and 11.04, consider restricting access to the apt-clone system state.tar.gz and system state.tar.gz files until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-0948

Affected Products

Update Manager

References · 7

• http://ubuntu.com/usn/USN-1443-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0948 · Security Note
• http://secunia.com/advisories/49230 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75727 · Note
• http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gz · Note
• http://securityfocus.com/bid/53604 · Note
• http://osvdb.org/82019 · Note