CVE-2010-0834

2022-10-0316:21:13

Debian Security Bug Tracker

security-tracker.debian.org

base-files package

remote code execution

ubuntu 9.10

ubuntu 10.04 lts

crafted package

authentication

dell latitude 2110 netbooks

man-in-the-middle

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.006 Low

EPSS

Percentile

77.9%

JSON

The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.

OSVersionArchitecturePackageVersionFilename
Debian12allbase-files< 12.4+deb12u6base-files_12.4+deb12u6_all.deb
Debian11allbase-files< 11.1+deb11u10base-files_11.1+deb11u10_all.deb
Debian999allbase-files< 13.3base-files_13.3_all.deb
Debian13allbase-files< 13.3base-files_13.3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	base-files	< 12.4+deb12u6	base-files_12.4+deb12u6_all.deb
Debian	11	all	base-files	< 11.1+deb11u10	base-files_11.1+deb11u10_all.deb
Debian	999	all	base-files	< 13.3	base-files_13.3_all.deb
Debian	13	all	base-files	< 13.3	base-files_13.3_all.deb