PT-2008-1006 · Debian · Apt-Listchanges

Published 2008-01-17 · Updated 2008-09-05 · CVE-2008-0302

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions apt-listchanges versions prior to 2.82

Description The issue is related to an untrusted search path vulnerability in the apt-listchanges.py script. This vulnerability allows local users to execute arbitrary code via a malicious apt-listchanges program in the current working directory. Multiple vulnerabilities in the apt-listchanges package may lead to breaches of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 2.82, update to version 2.82 or later to resolve the issue. As a temporary workaround, consider restricting access to the apt-listchanges.py script until a patch is available. Avoid executing the script from untrusted directories to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2015-00794

CVE-2008-0302

DSA-1465-2

Affected Products

Apt-Listchanges

References · 15

• 🔥 http://git.madism.org/?p=apt-listchanges.git;a=commitdiff;h=1bcfbf3dc55413bb83a1782dc9a54515a963fb32 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0302 · Security Note
• https://osv.dev/vulnerability/CVE-2008-0302 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0302 · Security Note
• http://ubuntu.com/usn/usn-572-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1465 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0302 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0302 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00794 · Security Note
• http://secunia.com/advisories/28574 · Note
• http://securityfocus.com/bid/27331 · Note
• http://git.madism.org/?p=apt-listchanges.git%3Ba=commitdiff%3Bh=1bcfbf3dc55413bb83a1782dc9a54515a963fb32 · Note
• http://secunia.com/advisories/28513 · Note
• http://packages.debian.org/changelogs/pool/main/a/apt-listchanges/apt-listchanges_2.82/changelog · Note
• http://debian.org/security/dsa-1465 · Note