Objavljena je revizija sigurnosnog upozorenja s oznakom USN-1443-1, vezanog uz nedostatke u paketu Update Manager. Udaljeni napadač spomenute propuste je mogao iskoristiti za otkrivanje osjetljivih podataka.
Paket:
update-manager 0.x
Operacijski sustavi:
Ubuntu Linux 11.04, Ubuntu Linux 11.10, Ubuntu Linux 12.04
Kritičnost:
5
Problem:
neodgovarajuće rukovanje datotekama, pogreška u programskoj komponenti
Iskorištavanje:
udaljeno
Posljedica:
otkrivanje osjetljivih informacija
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2012-0949, CVE-2012-0950
Izvorni ID preporuke:
USN-1443-2
Izvor:
Ubuntu
Problem:
Sigurnosne ranjivosti su posljedica pogrešnog rukovanja određenim datotekama koje sadržavaju informacije o sustavu u komponenti "Apport hook". Revizija je objavljena zbog izdavanja novih zakrpa za propust s oznakom CVE-2012-0949.
Posljedica:
Udaljeni napadač spomenute propuste može iskoristiti za čitanje osjetljivih informacija.
Rješenje:
Svim se korisnicima navedenog paketa savjetuje njegova nadogradnja na novije inačice.
==========================================================================
Ubuntu Security Notice USN-1443-2
June 04, 2012
update-manager vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
Summary:
Update Manager could expose sensitive information in certain circumstances.
Software Description:
- update-manager: GNOME application that manages apt updates
Details:
USN-1443-1 fixed vulnerabilities in Update Manager. The fix for
CVE-2012-0949 was discovered to be incomplete. This update fixes the
problem.
Original advisory details:
Felix Geyer discovered that the Update Manager Apport hook incorrectly
uploaded certain system state archive files to Launchpad when reporting
bugs. This could possibly result in repository credentials being included
in public bug reports. (CVE-2012-0949)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
update-manager-core 1:0.156.14.5
Ubuntu 11.10:
update-manager-core 1:0.152.25.12
Ubuntu 11.04:
update-manager-core 1:0.150.5.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1443-2
http://www.ubuntu.com/usn/usn-1443-1
CVE-2012-0950
Package Information:
https://launchpad.net/ubuntu/+source/update-manager/1:0.156.14.5
https://launchpad.net/ubuntu/+source/update-manager/1:0.152.25.12
https://launchpad.net/ubuntu/+source/update-manager/1:0.150.5.4
Posljednje sigurnosne preporuke