PT-2014-2204 · Debian · Advanced Package Tool

Simon Ruderich · Publicado 2014-04-15 · Atualizado 2014-04-16 · CVE-2012-0214

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Advanced Package Tool (APT) versions 0.8.11 through 0.8.15.10 Advanced Package Tool (APT) versions 0.8.16 before 0.8.16~exp13

Description The issue allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file. This leaves the original InRelease file active, making it more difficult to detect that the Packages file is modified and unsigned. The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc is involved in this issue.

Recommendations For Advanced Package Tool (APT) versions 0.8.11 through 0.8.15.10, update to version 0.8.16exp13 or later. For Advanced Package Tool (APT) versions 0.8.16 before 0.8.16exp13, update to version 0.8.16~exp13 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-0214

Produtos afetados

Advanced Package Tool

Referências · 7

• http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=b7a6594d1e5ed199a7a472b78b33e070375d6f92 · Nota
• http://ubuntu.com/usn/USN-1385-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-0214 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2012-0214 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0214 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-0214 · Aviso do Fabricante
• http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6 · Nota