==========================================================================
Ubuntu Security Notice USN-7063-1
October 11, 2024

ubuntu-advantage-desktop-daemon vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- - Ubuntu 24.04 LTS
- - Ubuntu 22.04 LTS
- - Ubuntu 20.04 LTS
- - Ubuntu 18.04 LTS
- - Ubuntu 16.04 LTS

Summary:

Ubuntu Advantage Desktop Daemon could be made to expose sensitive information.

Software Description:
- - ubuntu-advantage-desktop-daemon: Daemon to allow access to
ubuntu-advantage via D-Bus

Details:

Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon leaked
the Pro token to unprivileged users by passing the token as an argument
in plaintext. An attacker could use this issue to gain unauthorized access
to an Ubuntu Pro subscription. (CVE-2024-6388)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
ubuntu-advantage-desktop-daemon 1.11ubuntu0.1

Ubuntu 22.04 LTS
ubuntu-advantage-desktop-daemon 1.10.ubuntu0.22.04.2

Ubuntu 20.04 LTS
ubuntu-advantage-desktop-daemon 1.10.ubuntu0.20.04.1

Ubuntu 18.04 LTS
ubuntu-advantage-desktop-daemon 1.10.ubuntu0.18.04.1~esm1
Available with Ubuntu Pro

Ubuntu 16.04 LTS
ubuntu-advantage-desktop-daemon 1.10.ubuntu0.16.04.1~esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7063-1
CVE-2024-6388

Package Information:
https://launchpad.net/ubuntu/+source/ubuntu-advantage-desktop-daemon/1.11ubuntu0.1
https://launchpad.net/ubuntu/+source/ubuntu-advantage-desktop-daemon/1.10.ubuntu0.22.04.2
https://launchpad.net/ubuntu/+source/ubuntu-advantage-desktop-daemon/1.10.ubuntu0.20.04.1
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETB/nIDy9nvCSgAUj3gXQmO/Tr3wFAmcJXGoACgkQ3gXQmO/T
r3yg3Q/+JzokSz0NaoKK0RJQRzLd3uVD1le+tjU7ceG92a8K2dMPeNLI7ppbcM1Y
HwFkA0Ss08yinX5U6Frsz1obKpOKioJWc1GlMSAqXm/TxdG7GyrahIa8JG4tzViG
ySwXij8EGa5DQEpzrooBm2OWTG4y2GR5Ls1zh0zXCagQLw+HrfcFDdqUr8GZX49e
n5dEdSid3NQ0l6o9GFJ+9EljhCFMKK9J0ZohgeMdC1zGs3+bvA0N5Os0O1TWYBgB
CPKv1Ho2rNrT2H//oxjS+Bo31xFoL62/IkVAxie80I+91/Pm3tuscsa8tTiiywGh
azw3m7zapehfU+6megQU8ApRqHA1srEE8huL+Orq4/DjKzSDEsBz7CRCMxNyAipF
EI4jDBVciV1oUBbs7TCjqtnNMB2SuY9Rk7LrenCQpHcK/5vtvplrs0sSUSF2yvuE
yWYreCkx/dr11Qv+hK9ibgdFiiGTQNIERKERKQPPp1CXrsetzWFLRrIntA0jqkWE
D/g5bFS30n8TDsBvK68Lagw35TUqvMfLHk+rvb+Gws5+QrpBgrl/iwF5rJZ3eopJ
XDN4wnGAVrJXxXRoNLFtBVPGvD/Vmf7f3kWo131Q+8fNQa/At5hPN/nnYT3q9ZWJ
ePjJmfCK3/sN1I2y8lcx5ahEKzpfJYmvon2aTs7Sag/U0/Gf1SA=
=GNGa
-----END PGP SIGNATURE-----