Executive Summary

Informations
Name CVE-2011-3152 First vendor Publication 2014-04-27
Vendor Cve Last vendor Modification 2017-08-29

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Cvss Base Score 6.4 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3152

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-310 Cryptographic Issues

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 9
Os 5

OpenVAS Exploits

Date Description
2012-02-21 Name : Ubuntu Update for update-manager USN-1284-2
File : nvt/gb_ubuntu_USN_1284_2.nasl
2011-12-02 Name : Ubuntu Update for update-manager USN-1284-1
File : nvt/gb_ubuntu_USN_1284_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
77642 Update Manager Tar File Handling MitM Remote Arbitrary File Overwrite

Nessus® Vulnerability Scanner

Date Description
2012-02-17 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1284-2.nasl - Type : ACT_GATHER_INFO
2011-11-29 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1284-1.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/50833
CONFIRM https://bugs.launchpad.net/ubuntu/%2Bsource/update-manager/%2Bbug/881548
OSVDB http://www.osvdb.org/77642
SECUNIA http://secunia.com/advisories/47024
UBUNTU http://www.ubuntu.com/usn/USN-1284-1
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/71494

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
Date Informations
2020-05-23 00:30:57
  • Multiple Updates
2017-08-29 09:23:30
  • Multiple Updates
2016-06-28 18:48:01
  • Multiple Updates
2016-04-26 21:01:35
  • Multiple Updates
2014-04-28 21:21:37
  • Multiple Updates
2014-04-28 13:21:59
  • First insertion