PT-2013-2843 · Debian · Apt

Ansgar Burchardt · Published 2013-03-21 · Updated 2020-01-08 · CVE-2013-1051

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions apt versions 0.8.16 through 0.9.7

Description The issue is related to the handling of InRelease files, which can be exploited by man-in-the-middle attackers to modify packages before installation. This is possibly related to integrity checking and the use of third-party repositories.

Recommendations For apt versions 0.8.16 through 0.9.7, consider restricting the use of third-party repositories to minimize the risk of exploitation. As a temporary workaround, ensure that package integrity is thoroughly checked before installation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1051

Affected Products

Apt

References · 7

• http://ubuntu.com/usn/USN-1762-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1051 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1051 · Security Note
• http://secunia.com/advisories/52633 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1051 · Vendor Advisory
• http://osvdb.org/91428 · Note