Arbitrary Code Execution Vulnerability in APT by Debian
CVE-2014-0489

Currently unrated

Key Information:

Vendor
Debian
Status
Advanced Package Tool
Vendor
CVE Published:
3 November 2014

Summary

The vulnerability in APT allows remote attackers to execute arbitrary code by crafting malicious packages. When the Acquire::GzipIndexes option is enabled, APT fails to validate checksums, making it susceptible to exploit. This can lead to unauthorized actions executed on the system, posing significant security risks to users of affected versions prior to 1.0.9.

References

http://secunia.com/advisories/61286
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/61275
third-party-advisoryx_refsource_SECUNIA
http://ubuntu.com/usn/usn-2348-1
vendor-advisoryx_refsource_UBUNTU

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.