CVE-2012-0948
published 2012-06-07CVE-2012-0948: DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz…
PriorityP46low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
0.35%
28.1th percentile
DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| gnome | update-manager-core | — | — |
| gnome | update-manager-core | — | — |
| gnome | update-manager-core | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c2v8-h6rh-cf9h: DistUpgrade/DistUpgradeMain
ghsa_unreviewed·2022-05-17
CVE-2012-0948 [LOW] GHSA-c2v8-h6rh-cf9h: DistUpgrade/DistUpgradeMain
DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials.
Ubuntu
Update Manager vulnerabilities
vendor_ubuntu·2012-05-17·CVSS 2.1
CVE-2012-0948 [LOW] Update Manager vulnerabilities
Title: Update Manager vulnerabilities
Summary: Update Manager could expose sensitive information in certain circumstances.
It was discovered that Update Manager created system state archive files
with incorrect permissions when upgrading releases. A local user could
possibly use this to read repository credentials. (CVE-2012-0948)
Felix Geyer discovered that the Update Manager Apport hook incorrectly
uploaded certain system state archive files to Launchpad when reporting
bugs. This could possibly result in repository credentials being included
in public bug reports. (CVE-2012-0949)
Instructions: In general, a standard system update will make all the necessary changes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gzhttp://osvdb.org/82019http://secunia.com/advisories/49230http://www.securityfocus.com/bid/53604http://www.ubuntu.com/usn/USN-1443-1https://exchange.xforce.ibmcloud.com/vulnerabilities/75727http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gzhttp://osvdb.org/82019http://secunia.com/advisories/49230http://www.securityfocus.com/bid/53604http://www.ubuntu.com/usn/USN-1443-1https://exchange.xforce.ibmcloud.com/vulnerabilities/75727
2012-06-07
Published