CVE-2012-0954
Summary
| CVE | CVE-2012-0954 |
|---|---|
| State | PUBLISHED |
| Assigner | canonical |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-06-19 20:55:05 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:H/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Debian | Advanced Package Tool | 0.7.0 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.10 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.11 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.12 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.13 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.14 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.15 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.15 | exp1 | All | All |
| Application | Debian | Advanced Package Tool | 0.7.15 | exp2 | All | All |
| Application | Debian | Advanced Package Tool | 0.7.15 | exp3 | All | All |
| Application | Debian | Advanced Package Tool | 0.7.16 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.17 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.17 | exp1 | All | All |
| Application | Debian | Advanced Package Tool | 0.7.17 | exp2 | All | All |
| Application | Debian | Advanced Package Tool | 0.7.17 | exp3 | All | All |
| Application | Debian | Advanced Package Tool | 0.7.17 | exp4 | All | All |
| Application | Debian | Advanced Package Tool | 0.7.18 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.19 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.2 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.2-0.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.20 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.20.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.20.2 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.21 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.22 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.22.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.22.2 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.23 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.23.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.7.24 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.0 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.0 | pre1 | All | All |
| Application | Debian | Advanced Package Tool | 0.8.0 | pre2 | All | All |
| Application | Debian | Advanced Package Tool | 0.8.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.10 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.10.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.10.2 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.10.3 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.11 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.11.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.11.2 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.11.3 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.11.4 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.11.5 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.12 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.13 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.13.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.13.2 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.14 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.14.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15 | exp1 | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15 | exp2 | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15 | exp3 | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15.1 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15.10 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15.6 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15.7 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15.8 | All | All | All |
| Application | Debian | Advanced Package Tool | 0.8.15.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| USN-1475-1: APT update | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Ubuntu Linux APT CVE-2012-0954 Security Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Bug #1013639 “net-update verifcation checking is still insecure ...” : Bugs : “apt” package : Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | |
| USN-1477-1: APT vulnerability | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Full Disclosure: Strange gpg key shadowing | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | |
| Bug #1013128 “gpg key shadowing” : Bugs : “apt” package : Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | |
| Full Disclosure: Using second gpg keyring may be misleading? | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | |
| Full Disclosure: ubuntu apt-key (part 3) | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | |
| Bug #1013681 “make apt-key net-update secure” : Bugs : “apt” package : Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.