CVE:CVE-2015-1330
CNNVD:CNNVD-201507-003
unattended-upgrades是软件开发者Michael Vogt所维护的一个自动安装安全升级的脚本。
unattended-upgrades 0.86.1之前版本中存在安全漏洞，该漏洞源于当程序在DPkg::Options::* apt配置中启用‘force-confold’或‘force-confnew’dpkg选项时，没有正确对程序包执行身份验证。远程攻击者可利用该漏洞实施中间人攻击，上传并执行任意程序包。
solution:Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,14.10,15.04,and avoid the version 12.04,14.04,14.10,15.04; Upgrade debian unattended-upgrades to a higher version than 0.86,and avoid the version (,0.86]