PT-2020-18299 · Unknown+1 · Apt-Cacher-Ng+1
Matthias Gerstner
·
Published
2020-01-21
·
Updated
2022-01-01
·
CVE-2020-5202
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
apt-cacher-ng versions 3.3 and earlier
Description
The issue allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The
/usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can.Recommendations
For apt-cacher-ng versions 3.3 and earlier, as a temporary workaround, consider disabling the
acngtool program until a patch is available. Restrict access to the apt-cacher-ng daemon to minimize the risk of exploitation. Avoid using the AdminAuth option in /etc/apt-cacher-ng/security.conf until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse
Apt-Cacher-Ng