CVE-2014-0489
published 2014-11-03CVE-2014-0489: APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a…
PriorityP345high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.61%
88.2th percentile
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | advanced_package_tool | — | — |
| debian | apt | < apt 1.0.9 (bookworm) | apt 1.0.9 (bookworm) |
| debian | apt | >= 0 < 1.0.9 | 1.0.9 |
| debian | apt | >= 0 < 1.0.9 | 1.0.9 |
| debian | apt | >= 0 < 1.0.9 | 1.0.9 |
| debian | apt | >= 0 < 1.0.9 | 1.0.9 |
| debian | apt | >= 0 < 1.0.1ubuntu2.3 | 1.0.1ubuntu2.3 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
APT vulnerabilities
vendor_ubuntu·2014-09-16·CVSS 7.5
CVE-2014-0487 [HIGH] APT vulnerabilities
Title: APT vulnerabilities
Summary: Several security issues were fixed in APT.
It was discovered that APT did not re-verify downloaded files when the
If-Modified-Since wasn't met. (CVE-2014-0487)
It was discovered that APT did not invalidate repository data when it
switched from an unauthenticated to an authenticated state. (CVE-2014-0488)
It was discovered that the APT Acquire::GzipIndexes option caused APT to
skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and
Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)
It was discovered that APT did not correctly validate signatures when
manually downloading packages using the download command. This issue only
applied to Ubuntu 12.04 LTS. (CVE-2014-0490)
Instructions: In general, a standard system update
Debian
CVE-2014-0489: apt - APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not vali...
vendor_debian·2014·CVSS 7.5
CVE-2014-0489 [HIGH] CVE-2014-0489: apt - APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not vali...
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
Scope: local
bookworm: resolved (fixed in 1.0.9)
bullseye: resolved (fixed in 1.0.9)
forky: resolved (fixed in 1.0.9)
sid: resolved (fixed in 1.0.9)
trixie: resolved (fixed in 1.0.9)
GHSA
GHSA-x6q8-2q34-2w6w: APT before 1
ghsa_unreviewed·2022-05-13
CVE-2014-0489 [HIGH] CWE-20 GHSA-x6q8-2q34-2w6w: APT before 1
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
OSV
CVE-2014-0489: APT before 1
osv·2014-11-03·CVSS 7.5
CVE-2014-0489 [HIGH] CVE-2014-0489: APT before 1
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
OSV
apt vulnerabilities
osv·2014-09-16·CVSS 7.5
CVE-2014-0487 [HIGH] apt vulnerabilities
apt vulnerabilities
It was discovered that APT did not re-verify downloaded files when the
If-Modified-Since wasn't met. (CVE-2014-0487)
It was discovered that APT did not invalidate repository data when it
switched from an unauthenticated to an authenticated state. (CVE-2014-0488)
It was discovered that the APT Acquire::GzipIndexes option caused APT to
skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and
Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)
It was discovered that APT did not correctly validate signatures when
manually downloading packages using the download command. This issue only
applied to Ubuntu 12.04 LTS. (CVE-2014-0490)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0490 CVE-2014-0487 CVE-2014-0488 CVE-2014-0489 apt: multiple issues [fedora-all]
bugzilla·2014-09-18·CVSS 7.5
CVE-2014-0490 [HIGH] CVE-2014-0490 CVE-2014-0487 CVE-2014-0488 CVE-2014-0489 apt: multiple issues [fedora-all]
CVE-2014-0490 CVE-2014-0487 CVE-2014-0488 CVE-2014-0489 apt: multiple issues [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2014-0488 CVE-2014-0487 CVE-2014-0489 CVE-2014-0490 apt: multiple issues
bugzilla·2014-09-18·CVSS 7.5
CVE-2014-0488 [HIGH] CVE-2014-0488 CVE-2014-0487 CVE-2014-0489 CVE-2014-0490 apt: multiple issues
CVE-2014-0488 CVE-2014-0487 CVE-2014-0489 CVE-2014-0490 apt: multiple issues
A number of issues have been fixed in apt:
http://www.ubuntu.com/usn/usn-2348-1/
https://www.debian.org/security/2014/dsa-3025
CVE-2014-0488, CVE-2014-0487, CVE-2014-0489 commits:
https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git;a=commit;h=ca7fd76c2f30c100dcf1c12e717ce397cccd690b
https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git;a=commit;h=daff4aa356128310f022370f7825bdc369c66ba8
Unclear if CVE-2014-0490 affects the version in Fedora or not.
Discussion:
Created apt tracking bugs for this issue:
Affects: fedora-all [bug 1143816]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially
2014-11-03
Published