Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Ubuntu 14.04 LTS: USN-2353-1 Critical: APT Denial of Service

ubuntu
Calendar Grey September 23, 2014
Scroller Ubuntu
A newly discovered flaw in APT could let distant cybercriminals disrupt Ubuntu machines or run harmful scripts through specially designed data packets.
APT could be made to crash or run programs if it received specially crafted network traffic.

Summary

APT could be made to crash or run programs if it received specially crafted

network traffic.

Software Description:

- apt: Advanced front-end for dpkg

Details:

It was discovered that APT incorrectly handled certain http URLs. If a

remote attacker were able to perform a man-in-the-middle attack, this flaw

could be exploited to cause APT to crash, resulting in a denial of service,

or possibly execute arbitrary code. (CVE-2014-6273)

In addition, this update fixes regressions introduced by the USN-2348-1

security update: APT incorrectly handled file:/// sources on a different

partition, incorrectly handled Dir::state::lists set to a relative path,

and incorrectly handled cdrom: sources.

Topics%20covered

Topics Covered

security advisory denial of service critical remote code execution Ubuntu network issue APT

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  apt                             1.0.1ubuntu2.4.1

Ubuntu 12.04 LTS:
  apt                             0.8.16~exp12ubuntu10.20.1

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.17.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2353-1

CVE-2014-6273

Severity
critical
Lowest
Low
Medium
High
Critical

September 23, 2014

Topics%20covered

Topics Covered

security advisory denial of service critical remote code execution Ubuntu network issue APT

Package Information

https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.4.1
https://launchpad.net/ubuntu/+source/apt/0.8.16~exp12ubuntu10.20.1
https://launchpad.net/ubuntu/+source/apt/0.7.25.3ubuntu9.17.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.