CVE-2011-3152
First published: Sun Apr 27 2014(Updated: )
DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ubuntu | =10.10 | |
| Ubuntu | =8.04 | |
| Ubuntu | =11.04 | |
| Ubuntu Update Manager | =1\-0.152.25 | |
| Ubuntu | =11.10 | |
| Ubuntu Update Manager | <=1\:0.87.24 | |
| Ubuntu Update Manager | =1\-0.134.7 | |
| Ubuntu Update Manager | =1\-0.142.19 | |
| Ubuntu Update Manager | =1\-0.150 | |
| Ubuntu | =10.04 | |
| <=1\:0.87.24 | ||
| =1\-0.134.7 | ||
| =1\-0.142.19 | ||
| =1\-0.150 | ||
| =1\-0.152.25 | ||
| =8.04 | ||
| =10.04 | ||
| =10.10 | ||
| =11.04 | ||
| =11.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2011-3152?
CVE-2011-3152 has a medium severity rating due to its potential for unauthorized code execution during the update process.
How do I fix CVE-2011-3152?
To fix CVE-2011-3152, update the Update Manager to version 1:0.87.31.1 or later for affected Ubuntu distributions.
Which versions of Ubuntu are affected by CVE-2011-3152?
CVE-2011-3152 affects Ubuntu versions 8.04 through 11.10 that utilize specific versions of the Update Manager.
What kind of vulnerability is CVE-2011-3152?
CVE-2011-3152 is a security vulnerability that relates to GPG signature verification failure during update extractions.
Is there a workaround for CVE-2011-3152?
There are no recommended workarounds for CVE-2011-3152; updating to a secure version is the best course of action.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/10.10
- version/ubuntu/8.04
- version/ubuntu/11.04
- canonical/ubuntu update manager
- version/ubuntu update manager/1\-0.152.25
- version/ubuntu/11.10
- version/ubuntu update manager/1\:0.87.24
- version/ubuntu update manager/1\-0.134.7
- version/ubuntu update manager/1\-0.142.19
- version/ubuntu update manager/1\-0.150
- version/ubuntu/10.04