CVE-2011-3152

CVE-2011-3152 affects Ubuntu Update Manager before certain versions of DistUpgradeFetcherCore.py (before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5) on Ubuntu 8.04–11.10. The flaw is improper verificat...

Ubuntu: Security Advisory (USN-1284-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : update-manager regression (USN-1284-2)

USN-1284-1 fixed vulnerabilities in Update Manager. One of the fixes introduced a regression for Kubuntu users attempting to upgrade to a newer Ubuntu release. This update fixes the problem. We apologize for the inconvenience. David Black discovered that Update Manager incorrectly extracted the...

Ubuntu升级管理器GPG签名校验安全绕过漏洞

CVE ID：CVE-2011-3152 Ubuntu是一款基于linux内核的发行版本。 David Black发现更新管理器Update Manager在校验GPG签名之前不正确提取下载的升级tarball，如果远程攻击者可执行中间人攻击，此缺陷可导致用于替换任意文件 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux...

Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : update-manager vulnerabilities (USN-1284-1)

David Black discovered that Update Manager incorrectly extracted the downloaded upgrade tarball before verifying its GPG signature. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to replace arbitrary files. CVE-2011-3152 David Black...

USN-1284-1: Update Manager vulnerabilities

David Black discovered that Update Manager incorrectly extracted the downloaded upgrade tarball before verifying its GPG signature. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to replace arbitrary files. CVE-2011-3152 David Black...