PT-2014-2204 · Debian · Advanced Package Tool

Simon Ruderich · Published 2014-04-15 · Updated 2014-04-16 · CVE-2012-0214

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Advanced Package Tool (APT) versions 0.8.11 through 0.8.15.10 Advanced Package Tool (APT) versions 0.8.16 before 0.8.16~exp13

Description The issue allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file. This leaves the original InRelease file active, making it more difficult to detect that the Packages file is modified and unsigned. The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc is involved in this issue.

Recommendations For Advanced Package Tool (APT) versions 0.8.11 through 0.8.15.10, update to version 0.8.16exp13 or later. For Advanced Package Tool (APT) versions 0.8.16 before 0.8.16exp13, update to version 0.8.16~exp13 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-0214

Affected Products

Advanced Package Tool

References · 7

• http://ubuntu.com/usn/USN-1385-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0214 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-0214 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0214 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-0214 · Vendor Advisory
• http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=b7a6594d1e5ed199a7a472b78b33e070375d6f92 · Note
• http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6 · Note