Re: HTTPS enabled Debian Security repository

From	Hans-Christoph Steiner <hans@at.or.at>
Newsgroups	linux.debian.security
Subject	Re: HTTPS enabled Debian Security repository
Date	2017-10-30 10:10 +0100
Message-ID	<uGef0-3Dz-13@gated-at.bofh.it> (permalink)
References	(1 earlier) <uEM1s-3cc-9@gated-at.bofh.it> <uEV4K-l1-3@gated-at.bofh.it> <uFan8-2n7-3@gated-at.bofh.it> <uFpvP-4fM-1@gated-at.bofh.it> <uFuFb-7Od-1@gated-at.bofh.it>
Organization	@\|\|@

Show all headers | View raw


Ansgar Burchardt:
> Henrique de Moraes Holschuh writes:
>> On Fri, 27 Oct 2017, Hans-Christoph Steiner wrote:
>>> This idea that GPG signatures on the index files is enough has been
>>> totally disproven.  There was a bug in apt where Debian devices could be
>>> exploited by feeding them crafted InRelease files:
>>>
>>> https://www.debian.org/security/2016/dsa-3733
>>
>> This was the *one* bug of this sort in the entire lifetime of apt thus
>> far, AFAIK.
> 
> No, there was also
>    https://security-tracker.debian.org/tracker/CVE-2013-1051
> which I found.  That one was fairly easy to exploit (concatenate
> manipulated Release with wrong "-----BEGIN PGP SIGNATURE" markers and
> correctly signed InRelease; gpg would verify the signature at the end,
> but apt would use the unsigned, manipulated Release from the beginning)
> 
> Similar bugs were present in several other places in Debian's
> infrastructure as well.
> 
> The one from 2016 is harder to exploit: I asked on #-apt back then and
> the sample exploit had a 1/4 success change with a 1.3 GB InRelease file
> on a memory starved i386 system).

That hit rate is enough to build malware around...


>>> If HTTPS was used, that would mean exploiting that would require
>>
>> One of the dozens of zero-days already found in the TLS stack we had to
>> run like crazy to patch ?
> 
> That is still valid of course, though I'm not sure if GnuPG or TLS
> libraries get wider testing...
> 
> Ansgar
> 

Don't get me wrong, I agree that HTTPS is very overcomplicated and
terrible in a lot of ways.  But the days of plain HTTP/TCP are over.
All connections need to be moving towards encryption.  Even with HTTPS'
faults, we are better off using it than plain HTTP.

.hc

Thread

HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-10-26 10:50 +0200
  Re: HTTPS enabled Debian Security repository 林博仁 <buo.ren.lin@gmail.com> - 2017-10-26 10:50 +0200
    Re: HTTPS enabled Debian Security repository Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2017-10-26 20:30 +0200
      Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-27 12:50 +0200
        Re: HTTPS enabled Debian Security repository Morris Taylor <morris@eml.cc> - 2017-10-27 16:00 +0200
          Re: HTTPS enabled Debian Security repository Luca Filipozzi <lfilipoz@debian.org> - 2017-10-27 16:30 +0200
        Re: HTTPS enabled Debian Security repository Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-28 05:00 +0200
          Re: HTTPS enabled Debian Security repository Ansgar Burchardt <ansgar@debian.org> - 2017-10-28 10:30 +0200
            Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-30 10:10 +0100
              Re: HTTPS enabled Debian Security repository Russell Coker <russell@coker.com.au> - 2017-10-30 12:40 +0100
                Re: HTTPS enabled Debian Security repository Rob van der Putten <rob@sput.nl> - 2017-10-31 00:40 +0100
      Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:00 +0100
        Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 11:20 +0100
          Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:40 +0100
            Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 12:00 +0100
  Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-10-26 11:00 +0200
  Re: HTTPS enabled Debian Security repository Tototechy <angelmarckus@rediffmail.com> - 2020-01-16 17:00 +0100

csiph-web