CVE-2010-0834
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 2.71% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- ubuntu/ubuntu linux
- Source
- security@ubuntu.com
References
- http://secunia.com/advisories/40889Vendor Advisory
- http://www.securityfocus.com/bid/42280Patch
- http://www.ubuntu.com/usn/usn-968-1
- http://www.vupen.com/english/advisories/2010/2015Vendor Advisory
- http://secunia.com/advisories/40889Vendor Advisory
- http://www.securityfocus.com/bid/42280Patch
- http://www.ubuntu.com/usn/usn-968-1
- http://www.vupen.com/english/advisories/2010/2015Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.