PT-2009-6706 · Debian · Apt
Mcasadevall
+1
·
Published
1970-01-01
·
Updated
2020-01-08
·
CVE-2009-1358
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
apt versions prior to 0.7.21
Description
The issue concerns multiple vulnerabilities in the apt package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The problem arises because apt-get does not check for the correct error code from gpgv, causing apt to treat a repository as valid even when it has been signed with a revoked or expired key. This might allow remote attackers to trick apt into installing malicious repositories.
Recommendations
For versions prior to 0.7.21, update to version 0.7.21 or later to resolve the issue. As a temporary workaround, consider restricting the use of apt-get until a patch is available. Avoid using apt-get to install repositories from untrusted sources until the issue is resolved.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apt