Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Ubuntu 11.04 USN-1270-1 Critical: Software Center Installation Flaw

ubuntu
Calendar Grey November 21, 2011
Scroller Ubuntu
Critical security flaw in Ubuntu Software Center allows unauthorized installations and data exposure: USN-1270-1.
An attacker could trick Software Center into installing altered packages and repositories or exposing sensitive information over the network.

Summary

An attacker could trick Software Center into installing altered packages

and repositories or exposing sensitive information over the network.

Software Description:

- software-center: Utility for browsing, installing, and removing software

Details:

David B. discovered that Software Center incorrectly validated server

certificates when performing secure connections. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could be exploited to

view sensitive information or install altered packages and repositories.

Topics%20covered

Topics Covered

security advisory critical ubuntu installation issue network exposure software-center

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  software-center                 5.0.2ubuntu0.1

Ubuntu 11.04:
  software-center                 4.0.5ubuntu0.1

Ubuntu 10.10:
  software-center                 3.0.10ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1270-1

CVE-2011-3150

Severity
critical
Lowest
Low
Medium
High
Critical

November 21, 2011

Topics%20covered

Topics Covered

security advisory critical ubuntu installation issue network exposure software-center

Package Information

https://launchpad.net/ubuntu/+source/software-center/5.0.2ubuntu0.1
https://launchpad.net/ubuntu/+source/software-center/4.0.5ubuntu0.1
https://launchpad.net/ubuntu/+source/software-center/3.0.10ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.