Executive Summary

Summary
Title Update Manager vulnerabilities
Informations
NameUSN-1443-1First vendor Publication2012-05-17
VendorUbuntuLast vendor Modification2012-05-17
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score5Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04

Summary:

Update Manager could expose sensitive information in certain circumstances.

Software Description:
- update-manager: GNOME application that manages apt updates

Details:

It was discovered that Update Manager created system state archive files
with incorrect permissions when upgrading releases. A local user could
possibly use this to read repository credentials. (CVE-2012-0948)

Felix Geyer discovered that the Update Manager Apport hook incorrectly
uploaded certain system state archive files to Launchpad when reporting
bugs. This could possibly result in repository credentials being included
in public bug reports. (CVE-2012-0949)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
update-manager-core 1:0.156.14.4

Ubuntu 11.10:
update-manager-core 1:0.152.25.11

Ubuntu 11.04:
update-manager-core 1:0.150.5.3

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1443-1
CVE-2012-0948, CVE-2012-0949

Package Information:
https://launchpad.net/ubuntu/+source/update-manager/1:0.156.14.4
https://launchpad.net/ubuntu/+source/update-manager/1:0.152.25.11
https://launchpad.net/ubuntu/+source/update-manager/1:0.150.5.3


Original Source

Url : http://www.ubuntu.com/usn/USN-1443-1

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls
CWE-200Information Exposure

CPE : Common Platform Enumeration

TypeDescriptionCount
Application3
Os3

OpenVAS Exploits

DateDescription
2012-06-08Name : Ubuntu Update for update-manager USN-1443-2
File : nvt/gb_ubuntu_USN_1443_2.nasl
2012-05-22Name : Ubuntu Update for update-manager USN-1443-1
File : nvt/gb_ubuntu_USN_1443_1.nasl

Nessus® Vulnerability Scanner

DateDescription
2012-06-05Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1443-2.nasl - Type : ACT_GATHER_INFO
2012-05-18Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1443-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:00:05
  • Multiple Updates