PT-2012-2969 · Canonical · Update Manager+3

Felix Geyer · Published 2012-05-31 · Updated 2017-08-29 · CVE-2012-0949

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubuntu versions 11.04 through 12.04 LTS

Description The issue allows remote attackers to read repository credentials by viewing a public bug report, due to the Apport hook in Update Manager uploading certain system state archive files when reporting bugs to Launchpad.

Recommendations For Ubuntu versions 11.04 through 12.04 LTS, consider restricting access to the bug reporting feature in Launchpad to minimize the risk of exploitation. As a temporary workaround, avoid using the Apport hook in Update Manager until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-0949

Affected Products

Apport

Launchpad

Ubuntu

Update Manager

References · 6

• http://ubuntu.com/usn/USN-1443-1 · Vendor Advisory
• http://secunia.com/advisories/49230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0949 · Security Note
• http://securityfocus.com/bid/53605 · Note
• http://osvdb.org/82020 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75728 · Note