CVE-2012-0949
published 2012-05-31CVE-2012-0949: The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad…
PriorityP428medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.12%
80.0th percentile
The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6m23-76r2-6p43: The Apport hook (DistUpgradeApport
ghsa_unreviewed·2022-05-17·CVSS 5.0
CVE-2012-0950 [MEDIUM] CWE-200 GHSA-6m23-76r2-6p43: The Apport hook (DistUpgradeApport
The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0949.
GHSA
GHSA-gvj3-7p38-j75v: The Apport hook in Update Manager as used by Ubuntu 12
ghsa_unreviewed·2022-05-17
CVE-2012-0949 [MEDIUM] CWE-200 GHSA-gvj3-7p38-j75v: The Apport hook in Update Manager as used by Ubuntu 12
The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report.
Ubuntu
Update Manager vulnerability
vendor_ubuntu·2012-06-04·CVSS 5.0
CVE-2012-0950 [MEDIUM] Update Manager vulnerability
Title: Update Manager vulnerability
Summary: Update Manager could expose sensitive information in certain circumstances.
USN-1443-1 fixed vulnerabilities in Update Manager. The fix for
CVE-2012-0949 was discovered to be incomplete. This update fixes the
problem.
Original advisory details:
Felix Geyer discovered that the Update Manager Apport hook incorrectly
uploaded certain system state archive files to Launchpad when reporting
bugs. This could possibly result in repository credentials being included
in public bug reports. (CVE-2012-0949)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Update Manager vulnerabilities
vendor_ubuntu·2012-05-17·CVSS 2.1
CVE-2012-0948 [LOW] Update Manager vulnerabilities
Title: Update Manager vulnerabilities
Summary: Update Manager could expose sensitive information in certain circumstances.
It was discovered that Update Manager created system state archive files
with incorrect permissions when upgrading releases. A local user could
possibly use this to read repository credentials. (CVE-2012-0948)
Felix Geyer discovered that the Update Manager Apport hook incorrectly
uploaded certain system state archive files to Launchpad when reporting
bugs. This could possibly result in repository credentials being included
in public bug reports. (CVE-2012-0949)
Instructions: In general, a standard system update will make all the necessary changes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://osvdb.org/82020http://secunia.com/advisories/49230http://www.securityfocus.com/bid/53605http://www.ubuntu.com/usn/USN-1443-1https://exchange.xforce.ibmcloud.com/vulnerabilities/75728http://osvdb.org/82020http://secunia.com/advisories/49230http://www.securityfocus.com/bid/53605http://www.ubuntu.com/usn/USN-1443-1https://exchange.xforce.ibmcloud.com/vulnerabilities/75728
2012-05-31
Published