CVE-2010-0834 (GCVE-0-2010-0834)
Vulnerability from cvelistv5 – Published: 2010-08-09 20:00 – Updated: 2024-09-16 22:24
VLAI?
Summary
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:59:39.338Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "42280",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/42280"
},
{
"name": "40889",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40889"
},
{
"name": "ADV-2010-2015",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2015"
},
{
"name": "USN-968-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/usn-968-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-08-09T20:00:00Z",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"name": "42280",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/42280"
},
{
"name": "40889",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40889"
},
{
"name": "ADV-2010-2015",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2015"
},
{
"name": "USN-968-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/usn-968-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@ubuntu.com",
"ID": "CVE-2010-0834",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "42280",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/42280"
},
{
"name": "40889",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40889"
},
{
"name": "ADV-2010-2015",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2015"
},
{
"name": "USN-968-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/usn-968-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2010-0834",
"datePublished": "2010-08-09T20:00:00Z",
"dateReserved": "2010-03-03T00:00:00Z",
"dateUpdated": "2024-09-16T22:24:37.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:ubuntu:ubuntu_linux:9.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"27C9BF8A-AD42-401F-A8CA-486B6DCD47BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:ubuntu:ubuntu_linux:10.04:-:lts:*:*:*:*:*\", \"matchCriteriaId\": \"3976D70F-3D30-4EFF-9777-C687B293606B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:dell:latitude_2110_netbook:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"30DE3567-65F0-431D-B12A-B2764BA313FB\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.\"}, {\"lang\": \"es\", \"value\": \"El paquete base-files anterior a v5.0.0ubuntu7.1 en Ubuntu v9.10 y anterior a v5.0.0ubuntu20.10.04.2 en Ubuntu v10.04 LTS, como los incluidos en port\\u00e1tiles Dell Latitude 2110, no necesitan autenticaci\\u00f3n para la instalaci\\u00f3n de paquetes, lo que permite a atacantes con servidores de archivos remotos y \\\"man-in-the-middle\\\" (intermediario) ejecutar c\\u00f3digo de su elecci\\u00f3n a trav\\u00e9s de paquetes manipulados.\"}]",
"id": "CVE-2010-0834",
"lastModified": "2024-11-21T01:13:03.080",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 9.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.6, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2010-08-10T12:23:05.850",
"references": "[{\"url\": \"http://secunia.com/advisories/40889\", \"source\": \"security@ubuntu.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/42280\", \"source\": \"security@ubuntu.com\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.ubuntu.com/usn/usn-968-1\", \"source\": \"security@ubuntu.com\"}, {\"url\": \"http://www.vupen.com/english/advisories/2010/2015\", \"source\": \"security@ubuntu.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/40889\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/42280\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.ubuntu.com/usn/usn-968-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2010/2015\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "security@ubuntu.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2010-0834\",\"sourceIdentifier\":\"security@ubuntu.com\",\"published\":\"2010-08-10T12:23:05.850\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.\"},{\"lang\":\"es\",\"value\":\"El paquete base-files anterior a v5.0.0ubuntu7.1 en Ubuntu v9.10 y anterior a v5.0.0ubuntu20.10.04.2 en Ubuntu v10.04 LTS, como los incluidos en port\u00e1tiles Dell Latitude 2110, no necesitan autenticaci\u00f3n para la instalaci\u00f3n de paquetes, lo que permite a atacantes con servidores de archivos remotos y \\\"man-in-the-middle\\\" (intermediario) ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de paquetes manipulados.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ubuntu:ubuntu_linux:9.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"27C9BF8A-AD42-401F-A8CA-486B6DCD47BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ubuntu:ubuntu_linux:10.04:-:lts:*:*:*:*:*\",\"matchCriteriaId\":\"3976D70F-3D30-4EFF-9777-C687B293606B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dell:latitude_2110_netbook:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"30DE3567-65F0-431D-B12A-B2764BA313FB\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/40889\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/42280\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.ubuntu.com/usn/usn-968-1\",\"source\":\"security@ubuntu.com\"},{\"url\":\"http://www.vupen.com/english/advisories/2010/2015\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/40889\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/42280\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.ubuntu.com/usn/usn-968-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2010/2015\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…