PT-2014-1779 · Debian+1 · Apt+1

Jakub Wilk · Published 2014-06-12 · Updated 2020-01-08 · CVE-2014-0478

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions apt versions prior to 1.0.4

Description The issue concerns multiple vulnerabilities in the apt package of the Debian GNU/Linux operating system, which can be exploited to compromise the integrity and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, the problem arises from the failure to properly validate source packages, allowing man-in-the-middle attackers to download and install malicious packages by removing the Release signature.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the package installation process to minimize the risk of exploitation. Avoid using untrusted sources for package downloads until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-03029

CVE-2014-0478

DLA-0005-1

DSA-2958-1

USN-2246-1

Affected Products

Ubuntu

Apt

References · 17

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795 · Exploit
• https://bdu.fstec.ru/vul/2015-03029 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0478 · Security Note
• https://ubuntu.com/security/notices/USN-2246-1 · Vendor Advisory
• http://debian.org/security/2014/dsa-2958 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0478 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0478 · Security Note
• https://osv.dev/vulnerability/CVE-2014-0478 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0478 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2246-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0478 · Vendor Advisory
• http://ubuntu.com/usn/USN-2246-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0478 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0478 · Security Note
• http://secunia.com/advisories/59358 · Note