Ubuntu 12.04 LTS USN-1443-1 Moderate: Update Manager Info Leak

ubuntu

May 17, 2012

Update Manager could expose sensitive information in certain circumstances.

Summary

Update Manager could expose sensitive information in certain circumstances.

Software Description:

- update-manager: GNOME application that manages apt updates

Details:

It was discovered that Update Manager created system state archive files

with incorrect permissions when upgrading releases. A local user could

possibly use this to read repository credentials. (CVE-2012-0948)

Felix Geyer discovered that the Update Manager Apport hook incorrectly

uploaded certain system state archive files to Launchpad when reporting

bugs. This could possibly result in repository credentials being included

in public bug reports. (CVE-2012-0949)

Topics Covered

security advisory moderate information leak local access ubuntu bug report update-manager

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  update-manager-core             1:0.156.14.4

Ubuntu 11.10:
  update-manager-core             1:0.152.25.11

Ubuntu 11.04:
  update-manager-core             1:0.150.5.3

In general, a standard system update will make all the necessary changes.