Debian apt security update: man-in-the-middle arbitrary code execution

hiddenvulkcan

Yikes, that vuln in apt is pretty bad! I think a lot of the newer wave of vulnerabilities being found generally seem to have a low likelihood of being reached, but this seems somewhat plausible? I'm assuming this would be done by compromising a mirror, in order to do the redirect?

vesinisa

No word as of yet if Ubuntu's apt is also impacted. Sounds like the vulnerability is in the HTTP handling code, and because apt downloads packages over plain HTTP a man-in-the-middle position would be enough to exploit it. It almost seems like a repeat of two previous apt vulnerabilities: In 2019: https://lists.debian.org/debian-security-announce/2019/msg00... And in 2014: https://lists.debian.org/debian-security-announce/2014/msg00...

greggsy

> We recommend that you upgrade your apt packages. Is there a German word for a broken tool that can only be fixed by using the same broken tool?

mariofdistrust

yey, my computers and containers aren't vulnerable (^-^)

serbuvlad

It's always been strange to me and I've been saying forever that I don't get why package repos don't use HTTPS.

flotzam

Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)? If necessary, with instructions for downloading and verifying it out of band Or maybe by passing a parameter to the old apt that disables the vulnerable HTTP download resumption when downloading the new apt

InsidiousWombat

interesting, why is verification not running after package is already on hard drive in full ?

hypfer

If I understand correctly, trixie-security contains a fixed version, however, bookworm not (yet)? Is it going to be fixed for oldstable?

iamnothere

Bonus, the man in the middle can see what packages you’re downloading since you’re not using HTTPS, so they know if you’re vulnerable during an update. I never understood the insistence on using HTTP as a default for apt. Once HTTPS transport was available and tested (which took forever btw) then it should have become the default. Maybe this will spur some changes.

Avamander

Not surprised at all. I remember all of the heated discussions (even here on HN) around there being absolutely no need for HTTPS because "everything is signed with PGP". Exposing all of the internals of something to any and all MITM keeps on demonstrating how it's a dangerous idea. Hopefully this example settles at least some of this pointless discussion.

londons_explore

And APT was the one being very reluctant about using HTTPS because "we sign out stuff so don't need encryption". I think this demonstrates exactly why everything should be https.

edelbitter

Since this is the second time the redirect feature was broken in a serious way and there is still no obvious need for it.. time to make it opt-in instead of opt-out?