Re: HTTPS enabled Debian Security repository

From	Ansgar Burchardt <ansgar@debian.org>
Newsgroups	linux.debian.security
Subject	Re: HTTPS enabled Debian Security repository
Date	2017-10-28 10:30 +0200
Message-ID	<uFuFb-7Od-1@gated-at.bofh.it> (permalink)
References	<uEM1s-3cc-5@gated-at.bofh.it> <uEM1s-3cc-9@gated-at.bofh.it> <uEV4K-l1-3@gated-at.bofh.it> <uFan8-2n7-3@gated-at.bofh.it> <uFpvP-4fM-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Henrique de Moraes Holschuh writes:
> On Fri, 27 Oct 2017, Hans-Christoph Steiner wrote:
>> This idea that GPG signatures on the index files is enough has been
>> totally disproven.  There was a bug in apt where Debian devices could be
>> exploited by feeding them crafted InRelease files:
>> 
>> https://www.debian.org/security/2016/dsa-3733
>
> This was the *one* bug of this sort in the entire lifetime of apt thus
> far, AFAIK.

No, there was also
   https://security-tracker.debian.org/tracker/CVE-2013-1051
which I found.  That one was fairly easy to exploit (concatenate
manipulated Release with wrong "-----BEGIN PGP SIGNATURE" markers and
correctly signed InRelease; gpg would verify the signature at the end,
but apt would use the unsigned, manipulated Release from the beginning)

Similar bugs were present in several other places in Debian's
infrastructure as well.

The one from 2016 is harder to exploit: I asked on #-apt back then and
the sample exploit had a 1/4 success change with a 1.3 GB InRelease file
on a memory starved i386 system).

>> If HTTPS was used, that would mean exploiting that would require
>
> One of the dozens of zero-days already found in the TLS stack we had to
> run like crazy to patch ?

That is still valid of course, though I'm not sure if GnuPG or TLS
libraries get wider testing...

Ansgar

Thread

HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-10-26 10:50 +0200
  Re: HTTPS enabled Debian Security repository 林博仁 <buo.ren.lin@gmail.com> - 2017-10-26 10:50 +0200
    Re: HTTPS enabled Debian Security repository Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2017-10-26 20:30 +0200
      Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-27 12:50 +0200
        Re: HTTPS enabled Debian Security repository Morris Taylor <morris@eml.cc> - 2017-10-27 16:00 +0200
          Re: HTTPS enabled Debian Security repository Luca Filipozzi <lfilipoz@debian.org> - 2017-10-27 16:30 +0200
        Re: HTTPS enabled Debian Security repository Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-28 05:00 +0200
          Re: HTTPS enabled Debian Security repository Ansgar Burchardt <ansgar@debian.org> - 2017-10-28 10:30 +0200
            Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-30 10:10 +0100
              Re: HTTPS enabled Debian Security repository Russell Coker <russell@coker.com.au> - 2017-10-30 12:40 +0100
                Re: HTTPS enabled Debian Security repository Rob van der Putten <rob@sput.nl> - 2017-10-31 00:40 +0100
      Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:00 +0100
        Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 11:20 +0100
          Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:40 +0100
            Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 12:00 +0100
  Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-10-26 11:00 +0200
  Re: HTTPS enabled Debian Security repository Tototechy <angelmarckus@rediffmail.com> - 2020-01-16 17:00 +0100

csiph-web