Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Ubuntu 14.04 LTS USN-2348-1 Critical: APT Issues and Patches

ubuntu
Calendar Grey September 16, 2014
Scroller Ubuntu
Debian Security Alert DSA-4932-1 addresses flaws in the APT package affecting multiple stable branches. Protect your environment today.
Several security issues were fixed in APT.

Summary

Several security issues were fixed in APT.

Software Description:

- apt: Advanced front-end for dpkg

Details:

It was discovered that APT did not re-verify downloaded files when the

If-Modified-Since wasn't met. (CVE-2014-0487)

It was discovered that APT did not invalidate repository data when it

switched from an unauthenticated to an authenticated state. (CVE-2014-0488)

It was discovered that the APT Acquire::GzipIndexes option caused APT to

skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and

Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)

It was discovered that APT did not correctly validate signatures when

downloading source packages using the download command. This issue only

applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-0490)

Topics%20covered

Topics Covered

security advisory package update software fix authentication issue ubuntu apt download command

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  apt                             1.0.1ubuntu2.3

Ubuntu 12.04 LTS:
  apt                             0.8.16~exp12ubuntu10.19

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.16

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2348-1

CVE-2014-0487, CVE-2014-0488, CVE-2014-0489, CVE-2014-0490

Severity
critical
Lowest
Low
Medium
High
Critical

September 16, 2014

Topics%20covered

Topics Covered

security advisory package update software fix authentication issue ubuntu apt download command

Package Information

https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.3
https://launchpad.net/ubuntu/+source/apt/0.8.16~exp12ubuntu10.19
https://launchpad.net/ubuntu/+source/apt/0.7.25.3ubuntu9.16

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.