[Bug 814331] Re: [Oneiric] update-manager installs packages without authentication

[Brendan Donegan]

I can confirm this too - also I don't think it's proper to assign a bug
to yourself unless you're currently working on a fix. Unless we're all
mistaken here it seems like quite a serious security issue to allow
updates to be done with any authentication.

** Changed in: update-manager (Ubuntu)
   Importance: Undecided => High

** Changed in: update-manager (Ubuntu)
     Assignee: RedSingularity (redsingularity) => (unassigned)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to update-manager in Ubuntu.
https://bugs.launchpad.net/bugs/814331

Title:
  [Oneiric] update-manager installs packages without authentication

Status in “update-manager” package in Ubuntu:
  Confirmed

Bug description:
  Wait until update-manager in launcher calls for attention to upgrade.
  Click on launcher icon displays update-manger and a list of packages to upgrade.
  Click on install downloads and installs packages without authentication request.

  Regarding security and considering an upgrade an admin task it's
  expected to request authentication.

  ## Similar Bug #811166

  ProblemType: Bug
  DistroRelease: Ubuntu 11.10
  Package: update-manager 1:0.152.6
  ProcVersionSignature: Ubuntu 3.0-3.4-generic 3.0.0-rc5
  Uname: Linux 3.0-3-generic x86_64
  NonfreeKernelModules: wl
  Architecture: amd64
  Date: Fri Jul 22 00:20:09 2011
  InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Release amd64 (20110423)
  PackageArchitecture: all
  ProcEnviron:
   LANG=C
   SHELL=/bin/bash
  SourcePackage: update-manager
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/814331/+subscriptions