| Vulnerability Name: | CVE-2011-3154 (CCN-71493) | ||||||||||||
| Assigned: | 2011-11-28 | ||||||||||||
| Published: | 2011-11-28 | ||||||||||||
| Updated: | 2014-05-05 | ||||||||||||
| Summary: | DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file content for a user via a symlink attack on the temporary file. | ||||||||||||
| CVSS v3 Severity: | 4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||||||
| CVSS v2 Severity: | 1.9 Low (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N) 1.4 Low (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||||||
| Vulnerability Type: | CWE-59 | ||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2011-3154 Source: CCN Type: SA47024 Ubuntu update for update-manager Source: SECUNIA Type: UNKNOWN 47024 Source: CCN Type: OSVDB ID: 77641 Update Manager Insecure Temporary File Creation Local .XAUTHORITY File Disclosure Source: CCN Type: BID-50832 Ubuntu Update Manager Insecure Temporary Directory Creation Vulnerability Source: UBUNTU Type: Vendor Advisory USN-1284-1 Source: CCN Type: USN-1284-1 Update Manager vulnerabilities Source: CONFIRM Type: UNKNOWN https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/881541 Source: XF Type: UNKNOWN ubuntu-update-files-info-disc(71493) | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||