APT vulnerability

2011-11-2800:00:00

ubuntu.com

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

39.8%

JSON

Releases

Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04
Ubuntu 8.04

Packages

apt - Advanced front-end for dpkg

Details

It was discovered that APT incorrectly handled the Verify-Host
configuration option. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could potentially be used to steal
repository credentials. This issue only affected Ubuntu 10.04 LTS and
10.10. (CVE-2011-3634)

USN-1215-1 fixed a vulnerability in APT by disabling the apt-key net-update
option. This update re-enables the option with corrected verification.
Original advisory details:
It was discovered that the apt-key utility incorrectly verified GPG
keys when downloaded via the net-update option. If a remote attacker were
able to perform a machine-in-the-middle attack, this flaw could potentially be
used to install altered packages.

OSVersionArchitecturePackageVersionFilename
Ubuntu8.04noarchapt< 0.7.9ubuntu17.4UNKNOWN
Ubuntu8.04noarchapt-transport-https< 0.7.9ubuntu17.4UNKNOWN
Ubuntu8.04noarchapt-utils< 0.7.9ubuntu17.4UNKNOWN
Ubuntu8.04noarchlibapt-pkg-dev< 0.7.9ubuntu17.4UNKNOWN
Ubuntu11.04noarchapt< 0.8.13.2ubuntu4.3UNKNOWN
Ubuntu11.04noarchapt-transport-https< 0.8.13.2ubuntu4.3UNKNOWN
Ubuntu11.04noarchapt-utils< 0.8.13.2ubuntu4.3UNKNOWN
Ubuntu11.04noarchlibapt-pkg-dev< 0.8.13.2ubuntu4.3UNKNOWN
Ubuntu10.10noarchapt< 0.8.3ubuntu7.3UNKNOWN
Ubuntu10.10noarchapt-transport-https< 0.8.3ubuntu7.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	8.04	noarch	apt	< 0.7.9ubuntu17.4	UNKNOWN
Ubuntu	8.04	noarch	apt-transport-https	< 0.7.9ubuntu17.4	UNKNOWN
Ubuntu	8.04	noarch	apt-utils	< 0.7.9ubuntu17.4	UNKNOWN
Ubuntu	8.04	noarch	libapt-pkg-dev	< 0.7.9ubuntu17.4	UNKNOWN
Ubuntu	11.04	noarch	apt	< 0.8.13.2ubuntu4.3	UNKNOWN
Ubuntu	11.04	noarch	apt-transport-https	< 0.8.13.2ubuntu4.3	UNKNOWN
Ubuntu	11.04	noarch	apt-utils	< 0.8.13.2ubuntu4.3	UNKNOWN
Ubuntu	11.04	noarch	libapt-pkg-dev	< 0.8.13.2ubuntu4.3	UNKNOWN
Ubuntu	10.10	noarch	apt	< 0.8.3ubuntu7.3	UNKNOWN
Ubuntu	10.10	noarch	apt-transport-https	< 0.8.3ubuntu7.3	UNKNOWN