Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252

From	Patrick Schleizer <adrelanos@riseup.net>
Newsgroups	linux.debian.security
Subject	Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252
Date	2016-12-20 00:30 +0100
Message-ID	<sQfxv-5WR-19@gated-at.bofh.it> (permalink)
References	<sONN0-3MH-21@gated-at.bofh.it> <sP9kt-184-17@gated-at.bofh.it> <sPcim-2Vn-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

What about Debian graphical installer security?

Isn't that in meanwhile the ideal target for exploitation for targeted
attacks? Because it will take a while until the Debian point release
with fixed apt.

And during the gui installer, the output of apt-get is not visible. And
stuff during installer taking a long time is something users have been
trained to expect. So I don't think it would raise much suspicion. If
exploitation works, fine, if not, nothing was lost.

Also Debian gui installer may be distinguishable over the network from
already installed systems? Because first it's using debootstrap (perhaps
with special options), then apt-get. The timing or something else could
make it distinguishable over the network.

Best regards,
Patrick

Thread

not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-15 21:40 +0100
  Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 SZÉPE Viktor <viktor@szepe.net> - 2016-12-15 21:50 +0100
    Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Geert Stappers <stappers@stappers.nl> - 2016-12-16 07:00 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-16 15:20 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 SZÉPE Viktor <viktor@szepe.net> - 2016-12-16 15:50 +0100
  Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252 Paul Wise <pabs@debian.org> - 2016-12-16 00:40 +0100
  Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Julian Andres Klode <jak@debian.org> - 2016-12-16 00:40 +0100
    Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-16 23:40 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Julian Andres Klode <jak@debian.org> - 2016-12-17 00:30 +0100
        Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> - 2016-12-17 01:00 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 David Kalnischkies <david@kalnischkies.de> - 2016-12-17 02:50 +0100
        Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> - 2016-12-17 05:10 +0100
          Re: [qubes-devel] Re: not getting compromised while applying  apt-get upgrade for CVE-2016-1252 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-12-17 11:20 +0100
        Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-20 00:30 +0100
          Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Chris Laprise <tasket@openmailbox.org> - 2016-12-20 03:40 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Hans-Christoph Steiner <hans@at.or.at> - 2016-12-17 12:40 +0100
        Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Henrique de Moraes Holschuh <hmh@debian.org> - 2016-12-18 00:40 +0100

csiph-web