Software Center vulnerability

2011-11-2100:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.2

Confidence

Low

EPSS

0.013

Percentile

86.1%

JSON

Releases

Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.10

Packages

software-center - Utility for browsing, installing, and removing applications

Details

David B. discovered that Software Center incorrectly validated server
certificates when performing secure connections. If a remote attacker were
able to perform a machine-in-the-middle attack, this flaw could be exploited to
view sensitive information or install altered packages and repositories.

OSVersionArchitecturePackageVersionFilename
Ubuntu11.10noarchsoftware-center< 5.0.2ubuntu0.1UNKNOWN
Ubuntu11.04noarchsoftware-center< 4.0.5ubuntu0.1UNKNOWN
Ubuntu10.10noarchsoftware-center< 3.0.10ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	11.10	noarch	software-center	< 5.0.2ubuntu0.1	UNKNOWN
Ubuntu	11.04	noarch	software-center	< 4.0.5ubuntu0.1	UNKNOWN
Ubuntu	10.10	noarch	software-center	< 3.0.10ubuntu0.1	UNKNOWN