USN-1270-1: Software Center vulnerability

Ubuntu Security Notice USN-1270-1

21st November, 2011

software-center vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 11.10
  • Ubuntu 11.04
  • Ubuntu 10.10

Summary

An attacker could trick Software Center into installing altered packages and repositories or exposing sensitive information over the network.

Software description

  • software-center - Utility for browsing, installing, and removing applications

Details

David B. discovered that Software Center incorrectly validated server
certificates when performing secure connections. If a remote attacker were
able to perform a man-in-the-middle attack, this flaw could be exploited to
view sensitive information or install altered packages and repositories.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 11.10:
software-center 5.0.2ubuntu0.1
Ubuntu 11.04:
software-center 4.0.5ubuntu0.1
Ubuntu 10.10:
software-center 3.0.10ubuntu0.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2011-3150