VulnerabilityModified
CVE-2012-0944
Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack.
MEDIUM 4.3EPSS 1.21%
Does this matter?
Lower severity and a low EPSS score (1.21%). Track it; it rarely justifies an emergency change on its own.
Description
Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.21% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- sebastian heinlein/aptdaemon · canonical/ubuntu linux
- Source
- security@ubuntu.com
References
- http://secunia.com/advisories/48688Vendor Advisory
- http://ubuntu.com/usn/usn-1414-1
- http://www.osvdb.org/80887
- http://www.securityfocus.com/bid/52855
- https://bugs.launchpad.net/ubuntu/%2Bsource/aptdaemon/%2Bbug/959131
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74553
- http://secunia.com/advisories/48688Vendor Advisory
- http://ubuntu.com/usn/usn-1414-1
- http://www.osvdb.org/80887
- http://www.securityfocus.com/bid/52855
- https://bugs.launchpad.net/ubuntu/%2Bsource/aptdaemon/%2Bbug/959131
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74553
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.