aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property
CVE-2020-15703

4MEDIUM

Key Information:

Vendor

Canonical

Status
Aptdaemon
Vendor
CVE Published:
31 October 2020

What is CVE-2020-15703?

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

aptdaemon < 1.1.1+bzr982-0ubuntu32.2

aptdaemon < 1.1.1+bzr982-0ubuntu19.4

aptdaemon < 1.1.1+bzr982-0ubuntu14.4

References

https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubu...
x_refsource_MISC
https://ubuntu.com/security/notices/USN-4537-1
x_refsource_MISC

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vaisha Bernard
JSON
.