Remote code execution vulnerability in apt/apt-get

#1

Post by justicz » Tue, Jan 22, 2019, 2:20 PM UTC

Remote code execution vulnerability in apt/apt-get
justi.cz

Re: Remote code execution vulnerability in apt/apt-get

#2

Post by [deleted] » Tue, Jan 22, 2019, 3:35 PM UTC

[deleted]

Re: Remote code execution vulnerability in apt/apt-get

#3

Post by kuhhk » Tue, Jan 22, 2019, 3:37 PM UTC

> Thank you to the apt maintainers for patching this vulnerability quickly, and to the Debian security team for coordinating the disclosure. This bug has been assigned CVE-2019-3462.

From the article. Good stuff

Re: Remote code execution vulnerability in apt/apt-get

#4

Post by aboutruby » Tue, Jan 22, 2019, 3:38 PM UTC

> a malicious mirror could still exploit a bug like this, even with https. But I suspect that a network adversary serving an exploit is far more likely than deb.debian.org serving one or their TLS certificate getting compromised

Exactly, this is far more easily exploitable because apt is using HTTP by default instead of HTTPS

Re: Remote code execution vulnerability in apt/apt-get

#5

Post by rabi_penguin » Tue, Jan 22, 2019, 3:42 PM UTC

Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.

Re: Remote code execution vulnerability in apt/apt-get

#6

Post by jamp897 » Tue, Jan 22, 2019, 3:48 PM UTC

rabi_penguin wrote: post #5

Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.

He never explains why he wants to use HTTP, it’s only about why he thinks HTTPS isn’t nesscary.

Re: Remote code execution vulnerability in apt/apt-get

#7

Post by moviuro » Tue, Jan 22, 2019, 3:49 PM UTC

rabi_penguin wrote: post #5

Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.

OTOH, they would have been right if there had been (yet another) bug in openssl/whatever lib would be used for https.

FWIW: 16 vulns in apt in NVD [0]; but 202 for openssl [1]

[0] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...

[1] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&...

Re: Remote code execution vulnerability in apt/apt-get

#8

Post by feikname » Tue, Jan 22, 2019, 4:15 PM UTC

Seems like the discovery of this vuln was a direct result of yesterday's discussion about HTTPS on apt here on HN (https://news.ycombinator.com/item?id=18958679).

Re: Remote code execution vulnerability in apt/apt-get

#9

Post by jwilk » Tue, Jan 22, 2019, 4:20 PM UTC

rabi_penguin wrote: post #5

Hmm, it's almost as if the author of https://whydoesaptnotusehttps.com/ may have overlooked a few things.

Discussed yesterday:

https://news.ycombinator.com/item?id=18958679

Re: Remote code execution vulnerability in apt/apt-get

#10

Post by justicz » Tue, Jan 22, 2019, 4:20 PM UTC

feikname wrote: post #8

Seems like the discovery of this vuln was a direct result of yesterday's discussion about HTTPS on apt here on HN ( https://news.ycombinator.com/item?id=18958679 ).

Nope, I reported this bug several days ago. Funny coincidence though.