CVE-2011-3152

Publication date 28 November 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file.

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
update-manager 11.10 oneiric
Fixed 1:0.152.25.5
11.04 natty
Fixed 1:0.150.5.1
10.10 maverick
Fixed 1:0.142.23.1
10.04 LTS lucid
Fixed 1:0.134.11.1
8.04 LTS hardy
Fixed 1:0.87.31.1

References

Related Ubuntu Security Notices (USN)

    • USN-1284-1
    • Update Manager vulnerabilities
    • 28 November 2011

Other references