CVE-2012-0954
published 2012-06-19CVE-2012-0954: APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG…
PriorityP413low2.6CVSS 2.0
AVNACHAuNCNIPAN
EPSS
2.21%
80.6th percentile
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
osv2.6LOW
vendor_debian2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
APT vulnerability
vendor_ubuntu·2012-06-15
CVE-2012-0954 APT vulnerability
Title: APT vulnerability
Summary: An attacker could trick APT into installing altered packages.
Georgi Guninski discovered that APT did not properly validate imported
keyrings via apt-key net-update. USN-1475-1 added additional verification
for imported keyrings, but it was insufficient. If a remote attacker were
able to perform a machine-in-the-middle attack, this flaw could potentially be
used to install altered packages. This update corrects the issue by
disabling the net-update option completely. A future update will re-enable
the option with corrected verification.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2012-0954: apt - APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-upda...
vendor_debian·2012·CVSS 2.6
CVE-2012-0954 [LOW] CVE-2012-0954: apt - APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-upda...
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
Scope: local
bookworm: resolved (fixed in 0.7.25)
bullseye: resolved (fixed in 0.7.25)
forky: resolved (fixed in 0.7.25)
sid: resolved (fixed in 0.7.25)
trixie: resolved (fixed in 0.7.25)
GHSA
GHSA-86m4-88r3-mw4c: APT 0
ghsa_unreviewed·2022-05-13·CVSS 2.6
CVE-2012-0954 [LOW] CWE-20 GHSA-86m4-88r3-mw4c: APT 0
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
OSV
CVE-2012-0954: APT 0
osv·2012-06-19·CVSS 2.6
CVE-2012-0954 [LOW] CVE-2012-0954: APT 0
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2012/Jun/267http://seclists.org/fulldisclosure/2012/Jun/271http://seclists.org/fulldisclosure/2012/Jun/289http://www.securityfocus.com/bid/54046http://www.ubuntu.com/usn/USN-1475-1http://www.ubuntu.com/usn/USN-1477-1https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681http://seclists.org/fulldisclosure/2012/Jun/267http://seclists.org/fulldisclosure/2012/Jun/271http://seclists.org/fulldisclosure/2012/Jun/289http://www.securityfocus.com/bid/54046http://www.ubuntu.com/usn/USN-1475-1http://www.ubuntu.com/usn/USN-1477-1https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681
2012-06-19
Published