Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5131

Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252

Show all headers | View raw

On Thu, Dec 15, 2016 at 09:43:59PM +0100, SZÉPE Viktor wrote:
> Quoting Patrick Schleizer <adrelanos@riseup.net>:
> 
> >Very short summary of the bug:
> >(my own words) During apt-get upgrading signature verification can be
> >tricked resulting in arbitrary package installation, system compromise.
> >
> >- https://security-tracker.debian.org/tracker/CVE-2016-1252
> >- https://www.debian.org/security/2016/dsa-3733
> >- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467
> >
> >How to upgrade from the insecure apt-get version 1.0.9.8.3 to the
> >patched apt-get version 1.0.9.8.4 without being compromised during that
> >upgrade?
> >
> 
> You may download the new package
> http://security.debian.org/debian-security/pool/updates/main/a/apt/apt_1.0.9.8.4_amd64.deb
> (for amd64)

By the command

wget http://security.debian.org/debian-security/pool/updates/main/a/apt/apt_1.0.9.8.4_amd64.deb


> and check its checksum
> https://packages.debian.org/jessie/amd64/apt/download
> 
> $ sha256sum apt_1.0.9.8.4_amd64.deb
> 
> f40e51afbbcf2b1e23442c4c3df064a02ddc27bdfbfb155839577dcb1dedb74a
> 

Then the acual install

sudo dpkg --install apt_1.0.9.8.4_amd64.deb

Which might yield (due my test on a non-up-to-date-system)

(Reading database ... 42686 files and directories currently installed.)
Preparing to replace apt 1.0.9.8.4 (using apt_1.0.9.8.4_amd64.deb) ...
Unpacking replacement apt ...
dpkg: dependency problems prevent configuration of apt:
 apt depends on libapt-pkg4.12 (>= 1.0.9.8.4); however:
  Version of libapt-pkg4.12:amd64 on system is 0.9.7.9+deb7u6.
 apt depends on libc6 (>= 2.15); however:
  Version of libc6:amd64 on system is 2.13-38+deb7u8.
 apt depends on libstdc++6 (>= 4.9); however:
  Version of libstdc++6:amd64 on system is 4.7.2-5.

dpkg: error processing apt (--install):
 dependency problems - leaving unconfigured
Processing triggers for man-db ...
Errors were encountered while processing:
 apt




Groeten
Geert Stappers
-- 
Leven en laten leven

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-15 21:40 +0100
  Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 SZÉPE Viktor <viktor@szepe.net> - 2016-12-15 21:50 +0100
    Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Geert Stappers <stappers@stappers.nl> - 2016-12-16 07:00 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-16 15:20 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 SZÉPE Viktor <viktor@szepe.net> - 2016-12-16 15:50 +0100
  Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252 Paul Wise <pabs@debian.org> - 2016-12-16 00:40 +0100
  Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Julian Andres Klode <jak@debian.org> - 2016-12-16 00:40 +0100
    Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-16 23:40 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Julian Andres Klode <jak@debian.org> - 2016-12-17 00:30 +0100
        Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> - 2016-12-17 01:00 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 David Kalnischkies <david@kalnischkies.de> - 2016-12-17 02:50 +0100
        Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> - 2016-12-17 05:10 +0100
          Re: [qubes-devel] Re: not getting compromised while applying  apt-get upgrade for CVE-2016-1252 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-12-17 11:20 +0100
        Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-20 00:30 +0100
          Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Chris Laprise <tasket@openmailbox.org> - 2016-12-20 03:40 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Hans-Christoph Steiner <hans@at.or.at> - 2016-12-17 12:40 +0100
        Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Henrique de Moraes Holschuh <hmh@debian.org> - 2016-12-18 00:40 +0100

csiph-web