DSA-2958-1: APT - Authentication Bypass in apt-get source
Summary
DSA-2958-1: apt - security update. Affects apt versions < 0.9.7.9+deb7u2. Fixed in 0.9.7.9+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
APT is a high-level package manager used in Debian-based systems for managing software packages. It provides a command-line interface for package installation, upgrading, and removal. The 'apt-get source' command allows users to download source packages for inspection or modification. This vulnerability specifically affects the authentication checks performed by APT when downloading source packages using 'apt-get source'.
Vulnerability Detail
The vulnerability in APT allows an attacker to bypass authentication checks when downloading source packages via 'apt-get source'. This means that an attacker can potentially download malicious or tampered source packages without the proper authentication. However, it is important to note that this vulnerability only affects the use case of downloading source packages and does not impact regular package installation or upgrading.
How To Fix
Minimum fixed version
0.9.7.9+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade aptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in APT allows an attacker to bypass authentication checks when downloading source packages via 'apt-get source'. It is important to upgrade the APT package to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apt →
FAQ
APT (Advanced Package Tool) is a high-level package manager used in Debian-based systems for managing software packages. It provides a command-line interface for package installation, upgrading, and removal.
'apt-get source' is a command in APT that allows users to download source packages for inspection or modification. It retrieves the source code and related files for a specific package.
This vulnerability allows an attacker to bypass authentication checks when downloading source packages via 'apt-get source'. This means that an attacker can potentially download malicious or tampered source packages without the proper authentication.
No, this vulnerability only affects the use case of downloading source packages via 'apt-get source'. Regular package installation and upgrading are not impacted.
To fix this vulnerability, it is recommended to upgrade the APT package to the fixed versions. For the stable distribution (wheezy), upgrade to version 0.9.7.9+deb7u2. For the unstable distribution (sid), upgrade to version 1.0.4.
Related vulnerabilities
Recent vulnerabilities recorded for apt.
