APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.

It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488), performs incorrect verification of 304 replies (CVE-2014-0487) and does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489).

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2348-1 advisory.

    It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met.
    (CVE-2014-0487)

    It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to     an authenticated state. (CVE-2014-0488)

    It was discovered that the APT Acquire::GzipIndexes option caused APT to skip checksum validation. This     issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS, and was not enabled by default.
    (CVE-2014-0489)

    It was discovered that APT did not correctly validate signatures when manually downloading packages using     the download command. This issue only applied to Ubuntu 12.04 LTS. (CVE-2014-0490)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488 ), performs incorrect verification of 304 replies (CVE-2014-0487 ), does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489 ) and does not properly perform validation for binary packages downloaded by the apt-get download command (CVE-2014-0490 ).

ID	Name	Product	Family	Severity
82200	Debian DLA-53-1 : apt security update	Nessus	Debian Local Security Checks	high
77726	Ubuntu 14.04 LTS : APT vulnerabilities (USN-2348-1)	Nessus	Ubuntu Local Security Checks	critical
77715	Debian DSA-3025-1 : apt - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-0488

critical

Tenable Plugins

high

critical

high