Vulnerabilities > CVE-2020-5202

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

apt-cacher-ng-project

debian

opensuse

nessus

NVD

Published: 2020-01-21

Updated: 2022-01-01

Summary

apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can.

Vulnerable Configurations

Part	Description	Count
Application	Apt-Cacher-Ng_Project APT Cacher NG Project APT Cacher NG - APT Cacher NG Project APT Cacher NG 0.7.26 APT Cacher NG Project APT Cacher NG 0.7.26-1 APT Cacher NG Project APT Cacher NG 0.7.26-2 APT Cacher NG Project APT Cacher NG 0.7.27 APT Cacher NG Project APT Cacher NG 0.7.27-1 APT Cacher NG Project APT Cacher NG 0.8.0 APT Cacher NG Project APT Cacher NG 0.8.0-1 APT Cacher NG Project APT Cacher NG 0.8.0-2 APT Cacher NG Project APT Cacher NG 0.8.0-3 APT Cacher NG Project APT Cacher NG 0.8.1 APT Cacher NG Project APT Cacher NG 0.8.1-1 APT Cacher NG Project APT Cacher NG 0.8.2 APT Cacher NG Project APT Cacher NG 0.8.2-1 APT Cacher NG Project APT Cacher NG 0.8.3 APT Cacher NG Project APT Cacher NG 0.8.3-1 APT Cacher NG Project APT Cacher NG 0.8.4 APT Cacher NG Project APT Cacher NG 0.8.4-1 APT Cacher NG Project APT Cacher NG 0.8.5 APT Cacher NG Project APT Cacher NG 0.8.5-1 APT Cacher NG Project APT Cacher NG 0.8.5-2 APT Cacher NG Project APT Cacher NG 0.8.6 APT Cacher NG Project APT Cacher NG 0.8.6-1 APT Cacher NG Project APT Cacher NG 0.8.7 APT Cacher NG Project APT Cacher NG 0.8.7-1 APT Cacher NG Project APT Cacher NG 0.8.8 APT Cacher NG Project APT Cacher NG 0.8.8-1 APT Cacher NG Project APT Cacher NG 0.8.9 APT Cacher NG Project APT Cacher NG 0.8.9-1 APT Cacher NG Project APT Cacher NG 0.9.0 APT Cacher NG Project APT Cacher NG 0.9.0-1 APT Cacher NG Project APT Cacher NG 0.9.1 APT Cacher NG Project APT Cacher NG 0.9.1-1 APT Cacher NG Project APT Cacher NG 0.9.2 APT Cacher NG Project APT Cacher NG 0.9.2-1 APT Cacher NG Project APT Cacher NG 0.9.3 APT Cacher NG Project APT Cacher NG 0.9.3-1 APT Cacher NG Project APT Cacher NG 0.9.3.1 APT Cacher NG Project APT Cacher NG 0.9.3.1-1 APT Cacher NG Project APT Cacher NG 0.9.3.2 APT Cacher NG Project APT Cacher NG 0.9.3.2-1 APT Cacher NG Project APT Cacher NG 1 APT Cacher NG Project APT Cacher NG 1-2 APT Cacher NG Project APT Cacher NG 2 APT Cacher NG Project APT Cacher NG 2-1 APT Cacher NG Project APT Cacher NG 2-2 APT Cacher NG Project APT Cacher NG 3 APT Cacher NG Project APT Cacher NG 3-1 APT Cacher NG Project APT Cacher NG 3-2 APT Cacher NG Project APT Cacher NG 3-3 APT Cacher NG Project APT Cacher NG 3-4 APT Cacher NG Project APT Cacher NG 3-5 APT Cacher NG Project APT Cacher NG 3.1 APT Cacher NG Project APT Cacher NG 3.1-1 APT Cacher NG Project APT Cacher NG 3.1-Lp151.3.3.1 APT Cacher NG Project APT Cacher NG 3.2 APT Cacher NG Project APT Cacher NG 3.2-1 APT Cacher NG Project APT Cacher NG 3.2-2 APT Cacher NG Project APT Cacher NG 3.2-3 APT Cacher NG Project APT Cacher NG 3.3	71
OS	Debian Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0	3
OS	Opensuse Opensuse Leap 15.1 Opensuse Backports Sle-15	2

Nessus

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2020-124.NASL
description	This update for apt-cacher-ng fixes the following issues : - CVE-2019-18899: Fixed a symlink attack which could allow to overwrite arbitrary data (boo#1157703). - CVE-2020-5202: Fixed an information leak if a local user won a race condition to listen to localhost:3142 (boo#1157706).
last seen	2020-06-01
modified	2020-06-02
plugin id	133345
published	2020-01-30
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133345
title	openSUSE Security Update : apt-cacher-ng (openSUSE-2020-124)

Vulnerabilities > CVE-2020-5202 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2020-5202"}]}

Summary

Vulnerable Configurations

Nessus

References

Vulnerabilities > CVE-2020-5202