Directory Traversal Vulnerability in Update Manager for Ubuntu

CVE-2011-3152

Summary

A vulnerability exists in the Update Manager of Ubuntu, present in versions from 8.04 through 11.10, that compromises GPG signature verification for upgrade tarballs. Attackers can exploit this weakness through crafted tar files to perform directory traversal attacks, leading to the creation or overwriting of arbitrary files. Additionally, a crafted meta-release file can be used to bypass authentication, enabling unauthorized access to system upgrades.

References