HTTP redirect vulnerability in apt package manager

#1

Post by dansimau » Tue, Jan 22, 2019, 1:54 PM UTC

HTTP redirect vulnerability in apt package manager
lists.debian.org

Re: HTTP redirect vulnerability in apt package manager

#2

Post by est31 » Tue, Jan 22, 2019, 2:08 PM UTC

Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?

Re: HTTP redirect vulnerability in apt package manager

#3

Post by detaro » Tue, Jan 22, 2019, 2:12 PM UTC

est31 wrote: post #2

Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?

The attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html

Re: HTTP redirect vulnerability in apt package manager

#4

Post by jwilk » Tue, Jan 22, 2019, 3:38 PM UTC

Please use the original title.

Re: HTTP redirect vulnerability in apt package manager

#5

Post by mondoshawan » Tue, Jan 22, 2019, 4:45 PM UTC

Ironic, given the previous discussion on why apt shouldn't use HTTPS connections. With full end-to-end SSL validation, this kind of vulnerability can't exist. Should be interesting to see how the community reacta to this.

Re: HTTP redirect vulnerability in apt package manager

#6

Post by jwilk » Tue, Jan 22, 2019, 6:26 PM UTC

detaro wrote: post #3

est31 wrote: post #2

Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?

The attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html

Discussed on HN:

https://news.ycombinator.com/item?id=18968370