PT-2019-1258 · Debian+1 · Apt+1

Max Justicz · Publicado 2019-01-22 · Atualizado 2020-08-24 · CVE-2019-3462

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions apt versions 1.4.8 and earlier

Description The issue is related to incorrect sanitation of the 302 redirect field in the HTTP transport method, which can lead to content injection by a Man-In-The-Middle (MITM) attacker. This potentially allows for remote code execution on the target machine.

Recommendations For apt versions 1.4.8 and earlier, update to a version later than 1.4.8 to resolve the issue. As a temporary workaround, consider restricting the use of the HTTP transport method until a patch is available. Avoid using the HTTP protocol in apt configurations to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-300

Identificadores relacionados

BDU:2019-00415

CVE-2019-3462

DLA-1637-1

DSA-4371-1

USN-3863-1

USN-3863-2

Produtos afetados

Ubuntu

Apt

Referências · 28

• 🔥 https://github.com/tonejito/check_CVE-2019-3462 · Exploit
• https://osv.dev/vulnerability/DSA-4371-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3863-1 · Aviso do Fabricante
• http://securityfocus.com/bid/106690 · Nota
• https://osv.dev/vulnerability/CVE-2019-3462 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-3462 · Aviso do Fabricante
• https://t.me/ckure/2153 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20190125-0002 · Nota
• https://securityfocus.com/bid/106690 · Nota
• https://justi.cz/security/2019/01/22/apt-rce.html · Nota
• https://osv.dev/vulnerability/DLA-1637-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-3462 · Aviso do Fabricante
• https://usn.ubuntu.com/3863-1 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/320 · Publicação no Telegram