Cloudanix VulnDB

CVE-2020-16128

Low · 3.8

CVSS

3.8

EPSS

0.3%

Published

Dec 9, 2020

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Ubuntu's package-management helper could let someone already on the computer learn whether specific files exist, giving them extra information to plan other attacks.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Local process can query aptdaemon DBus interface to set Terminal or DebconfSocket properties and observe whether arbitrary files exist on the system.

Why it matters to the business

Attackers already present on an Ubuntu host can map file locations without elevated privileges, supporting reconnaissance for follow-on activity; the flaw affects a core package-management component on widely deployed Linux distributions.

How an attack unfolds

An attacker with an unprivileged local shell connects to the aptdaemon DBus service and repeatedly sets the Terminal or DebconfSocket properties to paths of interest; successful property acceptance versus error responses reveals file existence.

How to fix it

Upgrade aptdaemon to a patched release (1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+bzr982-0ubuntu19.5, or 1.1.1+bzr982-0ubuntu14.5 or later) via the distribution package manager and restart any running aptdaemon processes.

How to confirm the fix worked

Query the installed aptdaemon version with dpkg or apt; attempt the DBus property-setting calls from a non-root account and confirm that file-existence disclosure is no longer possible.

Typical attack path

  1. Obtain unprivileged local shell on Ubuntu host
  2. Connect to system DBus and locate aptdaemon service
  3. Invoke property setters on Terminal or DebconfSocket with candidate file paths
  4. Observe return values or error codes to map file presence
  5. Use discovered paths to refine further local attacks

How to detect it

Inspect system logs and DBus audit records for repeated SetProperty calls on the org.debian.apt or aptdaemon interfaces originating from non-root sessions; correlate with unusual file-path strings in those calls.

  • org.debian.apt.aptdaemon
  • SetProperty.*Terminal
  • SetProperty.*DebconfSocket

What your security team should do

  • Apply the listed aptdaemon updates on all Ubuntu systems within the next maintenance window
  • Restrict local accounts and monitor DBus activity for aptdaemon property modifications
  • Review package-management service exposure in container or desktop images

The record

The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affected versions prior to 1.1.1+bzr982-0ubuntu34.1, 1.1.1+bzr982-0ubuntu32.3, 1.1.1+bzr982-0ubuntu19.5, 1.1.1+bzr982-0ubuntu14.5.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS aptdaemon 0 1.1.1+bzr982-0ubuntu14.5
Ubuntu:18.04:LTS aptdaemon 0 1.1.1+bzr982-0ubuntu19.5
Ubuntu:20.04:LTS aptdaemon 0 1.1.1+bzr982-0ubuntu32.3

Related vulnerabilities