PT-2024-37585 · Canonical+1 · Ubuntu Advantage Desktop Daemon+2

Marco Trevisan · Published 2024-06-27 · Updated 2025-01-07 · CVE-2024-6388

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubuntu Advantage Desktop Daemon versions prior to 1.12

Description The Ubuntu Advantage Desktop Daemon leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.

Recommendations For versions prior to 1.12, update to version 1.12 or later to resolve the issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-497

CWE-319

Related Identifiers

CVE-2024-6388

USN-7063-1

Affected Products

Linuxmint

Ubuntu

Ubuntu Advantage Desktop Daemon

References · 12

• https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24 · Patch
• https://ubuntu.com/security/notices/USN-7063-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6388 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6388 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7063-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6388 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-6388 · Security Note
• https://ubuntu.com/security/CVE-2024-6388 · Vendor Advisory
• https://t.me/cvenotify/84693 · Telegram Post
• https://twitter.com/fluidattacks/status/1874872282188845269 · Twitter Post
• https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944 · Note
• https://twitter.com/fluidattacks/status/1876745877915574782 · Twitter Post