Auth bypass in Sebastian Heinlein Aptdaemon
CVE-2012-0944
Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack.
Vulnerability class: Broken Authentication
EPSS: 0.012 (65.3th percentile) — read the EPSS interpretation.
Affected products
- Sebastian_heinlein Aptdaemon — versions 0.20, 0.30, 0.31
- Canonical Ubuntu_linux — versions 11.04, 11.10, 12.04
- N/a — versions n/a
Weakness classification (CWE)
References
- security@ubuntu.com (vdb-entry, x_refsource_BID)
- security@ubuntu.com (x_refsource_CONFIRM)
- security@ubuntu.com (x_refsource_OSVDB, vdb-entry)
- security@ubuntu.com (x_refsource_UBUNTU, vendor-advisory)
- security@ubuntu.com (vdb-entry, x_refsource_XF)
- security@ubuntu.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)