Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5134

Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252

Show all headers | View raw

Julian Andres Klode:
> (2) look at the InRelease file and see if it contains crap
>     after you updated (if it looks OK, it's secure - you need
>     fairly long lines to be able to break this)

Thank you for that hint, Julian!

Can you please elaborate on this? (I am asking for Qubes and Whonix
(derivatives of Debian) build security purposes. [1])

Could you please provide information on how long safe / unsafe lines are
or how to detect them?

Ideally could you please provide some sanity check command that could be
used to detect malicious InRelease files such as 'find /var/lib/apt
-name '*InRelease*' -size +2M' or so?

The problem is,

- debootstrap can only bootstrap from one source such as
'http://ftp.de.debian.org/debian' - which still contains vulnerable apt.
(Correct me if I am wrong, I would hope to be wrong on that one.)

- bootstrapping from 'http://security.debian.org' is not possible
[contains only security updates, not a complete repository].

- So in conclusion one has a chance to get compromised when
bootstrapping from 'http://ftp.de.debian.org/debian' and then apt-get
upgrading from 'http://security.debian.org'.

Is there any way to break this cycle?

Best regards,
Patrick

[1] https://github.com/QubesOS/qubes-issues/issues/2520

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-15 21:40 +0100
  Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 SZÉPE Viktor <viktor@szepe.net> - 2016-12-15 21:50 +0100
    Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Geert Stappers <stappers@stappers.nl> - 2016-12-16 07:00 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-16 15:20 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 SZÉPE Viktor <viktor@szepe.net> - 2016-12-16 15:50 +0100
  Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252 Paul Wise <pabs@debian.org> - 2016-12-16 00:40 +0100
  Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Julian Andres Klode <jak@debian.org> - 2016-12-16 00:40 +0100
    Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-16 23:40 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Julian Andres Klode <jak@debian.org> - 2016-12-17 00:30 +0100
        Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> - 2016-12-17 01:00 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 David Kalnischkies <david@kalnischkies.de> - 2016-12-17 02:50 +0100
        Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> - 2016-12-17 05:10 +0100
          Re: [qubes-devel] Re: not getting compromised while applying  apt-get upgrade for CVE-2016-1252 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-12-17 11:20 +0100
        Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Patrick Schleizer <adrelanos@riseup.net> - 2016-12-20 00:30 +0100
          Re: [qubes-devel] Re: not getting compromised while applying apt-get  upgrade for CVE-2016-1252 Chris Laprise <tasket@openmailbox.org> - 2016-12-20 03:40 +0100
      Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Hans-Christoph Steiner <hans@at.or.at> - 2016-12-17 12:40 +0100
        Re: not getting compromised while applying apt-get upgrade for  CVE-2016-1252 Henrique de Moraes Holschuh <hmh@debian.org> - 2016-12-18 00:40 +0100

csiph-web