CVE-2012-0944

Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/48688	Vendor Advisory
http://ubuntu.com/usn/usn-1414-1
http://www.osvdb.org/80887
http://www.securityfocus.com/bid/52855
https://bugs.launchpad.net/ubuntu/%2Bsource/aptdaemon/%2Bbug/959131
https://exchange.xforce.ibmcloud.com/vulnerabilities/74553

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sebastian_heinlein:aptdaemon::::::::
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.20:::::::*
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.30:::::::*
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.31:::::::*
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.32:::::::*
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.33:::::::*
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.34:::::::*
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.40:::::::*
	cpe:2.3:a:sebastian_heinlein:aptdaemon:0.41:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:11.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:12.04:lts::::::

History

No history.

Information

Published : 2012-06-04 20:55

Updated : 2017-08-29 01:31

NVD link : CVE-2012-0944

Mitre link : CVE-2012-0944

CVE.ORG link : CVE-2012-0944

JSON object : View

Products Affected

canonical

ubuntu_linux

sebastian_heinlein

aptdaemon

CWE

CWE-287

Improper Authentication

{"id": "CVE-2012-0944", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-06-04T20:55:02.667", "references": [{"url": "http://secunia.com/advisories/48688", "tags": ["Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "http://ubuntu.com/usn/usn-1414-1", "source": "security@ubuntu.com"}, {"url": "http://www.osvdb.org/80887", "source": "security@ubuntu.com"}, {"url": "http://www.securityfocus.com/bid/52855", "source": "security@ubuntu.com"}, {"url": "https://bugs.launchpad.net/ubuntu/%2Bsource/aptdaemon/%2Bbug/959131", "source": "security@ubuntu.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74553", "source": "security@ubuntu.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack."}, {"lang": "es", "value": "v0.43 y anteriores en Ubuntu 11.04, v11.10, y v12.04 LTS no autentica los paquetes cuando la transacci\u00f3n no es simulada, lo que permite a atacantes remotos a instalar paquetes a trav\u00e9s de ataques \"man-in-the-middle\"."}], "lastModified": "2017-08-29T01:31:07.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDA070A6-E888-45FA-A51C-5AAF94575186", "versionEndIncluding": "0.42"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DC245C4-29B1-4932-B2AC-DD839AE73F80"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF35FE2C-069A-4655-B89D-09E1D8A6AAA7"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C17B1B89-B1F8-4033-8B55-4103D3B25055"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.32:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12ADB378-57FF-4119-B366-70CD9404F021"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.33:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "274F5887-CA53-4F3E-B4A1-4E47B9630452"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DB11186-CA4D-48F6-8B55-91D3D7B8603A"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFBCA267-B4A8-4D72-AEB5-90E1CD811C80"}, {"criteria": "cpe:2.3:a:sebastian_heinlein:aptdaemon:0.41:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C2B6B38-1636-4B5F-9D08-65F8F3C46D5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF49D26F-142E-468B-87C1-BABEA445255C"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4174F4F-149E-41A6-BBCC-D01114C05F38"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:lts:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7634053-30B3-4577-9B13-1782DD5B9762"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}