There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.
References
| Link | Resource |
|---|---|
| https://ubuntu.com/security/notices/USN-4537-1 | Patch Third Party Advisory |
| https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html | Exploit Third Party Advisory |
| https://ubuntu.com/security/notices/USN-4537-1 | Patch Third Party Advisory |
| https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://ubuntu.com/security/notices/USN-4537-1 - Patch, Third Party Advisory | |
| References | () https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 4.0 |
Information
Published : 2020-10-31 04:15
Updated : 2024-11-21 05:06
NVD link : CVE-2020-15703
Mitre link : CVE-2020-15703
CVE.ORG link : CVE-2020-15703
JSON object : View
Products Affected
aptdaemon_project
- aptdaemon
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')