Debian apt Repository Signature Verification Vulnerability
BID:34630
Info
Debian apt Repository Signature Verification Vulnerability
| Bugtraq ID: | 34630 |
| Class: | Design Error |
| CVE: |
CVE-2009-1358 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 20 2009 12:00AM |
| Updated: | Apr 27 2009 01:36PM |
| Credit: | martin f krafft |
| Vulnerable: |
Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Debian apt 0.7.20 .2 Debian apt 0.7.20 .1 Debian apt 0.7.20 |
| Not Vulnerable: |
Debian apt 0.7.21 |
Discussion
Debian apt Repository Signature Verification Vulnerability
Debian 'apt' is prone to a signature-verification vulnerability.
An attacker may exploit this issue by first compromising a repository server or through man-in-the-middle attacks after gaining access to revoked or expired keys. Successful attacks may allow the attacker to execute arbitrary code on a vulnerable computer.
Versions prior to 'apt' 0.7.21 are affected.
Debian 'apt' is prone to a signature-verification vulnerability.
An attacker may exploit this issue by first compromising a repository server or through man-in-the-middle attacks after gaining access to revoked or expired keys. Successful attacks may allow the attacker to execute arbitrary code on a vulnerable computer.
Versions prior to 'apt' 0.7.21 are affected.
Exploit / POC
Debian apt Repository Signature Verification Vulnerability
An attacker can exploit this issue by using readily available utilities.
An attacker can exploit this issue by using readily available utilities.
Solution / Fix
Debian apt Repository Signature Verification Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Debian apt Repository Signature Verification Vulnerability
References:
References:
- apt Product Page (Debian)
- Debian Bug report logs - #433091 (martin f krafft)
- Debian Changelog apt (0.7.21) (Debian)