APT flaw makes download retry settings part of Debian and Ubuntu patch reviews
A disclosed APT vulnerability can let an attacker replace a package that has already been checked with an attacker-controlled package. According to advisories from Debian, Ubuntu and the APT development team, the attacke
A disclosed APT vulnerability can let an attacker replace a package that has already been checked with an attacker-controlled package. According to advisories from Debian, Ubuntu and the APT development team, the attacker's code then runs with root privileges when the package is installed.
Exposure depends on both download retry settings and the attacker's ability to modify downloaded content. An operating system version alone does not establish whether a machine is affected.
Retry settings determine exposure
According to Ubuntu, Debian 11 and Ubuntu 20.04 are unaffected in their default configurations. However, the APT development team says user scripts may have enabled Acquire::Retries on these releases. Starting with Debian 12 and Ubuntu 22.04, retries for failed downloads are enabled by default.
Exploitation requires APT to retry a failed download and an attacker to interfere with the downloaded content. Ubuntu says an actor able to modify HTTP traffic between APT and a package server can meet this condition, including through a malicious mirror or proxy. The vulnerability can break the connection between the package that was checked and the package ultimately installed.
TMGS recommendations
TMGS recommends reviewing the effective configuration and package download path alongside patch status:
- Inventory installed APT packages and retry settings, including settings introduced by installation and update scripts. Include Debian 11 and Ubuntu 20.04 wherever
Acquire::Retriesis enabled. - Identify package servers, mirrors and proxies. Investigate unexpected configuration changes and restrict permission to modify relevant settings.
- Compare installed APT packages with the distribution's security advisories to confirm fixes are installed, and track machines awaiting updates.
For organizations using an external Linux operations provider, TMGS recommends requesting reports by machine group covering APT versions, retry settings and update results.
Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/lo-hong-apt-kiem-tra-ca-cau-hinh-thu-tai-lai-i.215538dd-3061-4992-bea3-b74cfa709b23
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.