Security · High impactFan score 46 · Tier B2 sources78 comments in the community
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
The Hacker News · By info@thehackernews.com (The Hacker News) ·
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and APT's developers published on November 4…
The Brief
- A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a verified package for their own.
- The attacker's code then runs as root, according to advisories published by Debian, Ubuntu and APT's developers on November 4.
- Commenters say APT downloads packages over plain HTTP, so a man-in-the-middle position is enough to exploit the flaw.
Why it matters
Any Debian or Ubuntu system that installs or updates packages over a network path an attacker can influence may run attacker code as root until APT is upgraded.
Who’s affected
- Debian and Ubuntu administrators
- Teams running APT-based containers and images
- Users who fetch packages over plain HTTP
What to do
- Upgrade the apt package to the fixed version, as the advisories recommend
- Check whether systems still on older Debian releases such as bookworm have received a fix
- #apt
- #debian
- #ubuntu
- #security
- #man-in-the-middle
- #package-manager
What developers are saying
Based on 78 comments · Mostly critical
Commenters are alarmed that APT's HTTP handling can be exploited by a man-in-the-middle and see it as a repeat of earlier APT flaws. Many argue that package repositories should default to HTTPS, while a few recall that APT's developers had resisted HTTPS on the grounds that signatures were enough. Others criticise the lack of upgrade guidance and note that the fix may not yet cover older releases.
- HTTP instead of HTTPS40%
- Repeat of earlier APT flaws20%
- Redirect feature should be opt-in15%
- Fix availability for older releases15%
- Lack of upgrade guidance10%
In favour
- + Packages are signed with PGP, which earlier discussions treated as sufficient protection without HTTPS
Concerns
- − Plain HTTP lets a man-in-the-middle see which packages are downloaded and whether they are vulnerable
- − Repeated serious breakage of the redirect feature suggests it is risky and not clearly needed
- − Advisories gave no guidance on securely updating apt itself
- − Fixed version appears in trixie-security, but bookworm is not yet fixed
“Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)?”
“I think this demonstrates exactly why everything should be https.”
“Since this is the second time the redirect feature was broken in a serious way and there is still no obvious need for it.. time to make it opt-in instead of opt-out?”
