Executive Summary

Summary
Title Update Manager vulnerabilities
Informations
NameUSN-1443-1First vendor Publication2012-05-17
VendorUbuntuLast vendor Modification2012-05-17
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score5Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04

Summary:

Update Manager could expose sensitive information in certain circumstances.

Software Description: - update-manager: GNOME application that manages apt updates

Details:

It was discovered that Update Manager created system state archive files with incorrect permissions when upgrading releases. A local user could possibly use this to read repository credentials. (CVE-2012-0948)

Felix Geyer discovered that the Update Manager Apport hook incorrectly uploaded certain system state archive files to Launchpad when reporting bugs. This could possibly result in repository credentials being included in public bug reports. (CVE-2012-0949)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS:
update-manager-core 1:0.156.14.4

Ubuntu 11.10:
update-manager-core 1:0.152.25.11

Ubuntu 11.04:
update-manager-core 1:0.150.5.3

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1443-1
CVE-2012-0948, CVE-2012-0949

Package Information:
https://launchpad.net/ubuntu/+source/update-manager/1:0.156.14.4
https://launchpad.net/ubuntu/+source/update-manager/1:0.152.25.11
https://launchpad.net/ubuntu/+source/update-manager/1:0.150.5.3

Original Source

Url : http://www.ubuntu.com/usn/USN-1443-1

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls
CWE-200Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17504
 
Oval ID: oval:org.mitre.oval:def:17504
Title: USN-1443-1 -- update-manager vulnerabilities
Description: Update Manager could expose sensitive information in certain circumstances.
Family: unix Class: patch
Reference(s): USN-1443-1
CVE-2012-0948
CVE-2012-0949
Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Product(s): update-manager
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application3
Os3

OpenVAS Exploits

DateDescription
2012-06-08Name : Ubuntu Update for update-manager USN-1443-2
File : nvt/gb_ubuntu_USN_1443_2.nasl
2012-05-22Name : Ubuntu Update for update-manager USN-1443-1
File : nvt/gb_ubuntu_USN_1443_1.nasl

Nessus® Vulnerability Scanner

DateDescription
2012-06-05Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1443-2.nasl - Type : ACT_GATHER_INFO
2012-05-18Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1443-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:00:05
  • Multiple Updates