VulnerabilityModified
CVE-2011-0724
The Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private keys after installation, which causes each installation to have the same fixed key, which allows remote attackers to gain privileges.
HIGH 9.3EPSS 2.93%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private keys after installation, which causes each installation to have the same fixed key, which allows remote attackers to gain privileges.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 2.93% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- ubuntu/edubuntu · ubuntu/live dvd
- Source
- security@ubuntu.com
References
- http://www.securityfocus.com/bid/46346
- http://www.ubuntu.com/usn/USN-1061-1Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0378Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65389
- http://www.securityfocus.com/bid/46346
- http://www.ubuntu.com/usn/USN-1061-1Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0378Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65389
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.