"We recommend that you upgrade your apt packages." with apt of course... (via https://twitter.com/ioerror)
https://www.debian.org/security/2014/dsa-3025
"It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488), performs incorrect verification of 304 replies (CVE-2014-0487), does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489) and does not properly perform validation for binary packages downloaded by the apt-get download command (CVE-2014-0490)."
This discussion has been archived.
No new comments can be posted.
Debian Security Advisory - DSA-3025-1 apt - Security Update
|
Log In/Create an Account
| Top
| 11 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(Score: 4, Informative) by _NSAKEY on Friday September 19 2014, @08:58AM
wget the .debs for both apt [debian.org] and apt-utils [debian.org]. Install with dpkg -i. Done.
(Score: 3, Interesting) by mtrycz on Friday September 19 2014, @09:13AM
I might not be getting it: is there a clear reason not to update it with apt?
In capitalist America, ads view YOU!
(Score: 3, Informative) by _NSAKEY on Friday September 19 2014, @09:22AM
Aside from avoiding the irony of updating apt by using apt? Not unless you're really paranoid.
(Score: 3, Insightful) by mth on Friday September 19 2014, @09:41AM
Bypassing apt altogether skips all security checks, so that would be a lot less safe than apt skipping some of the checks in particular situations.
(Score: 3, Informative) by q.kontinuum on Friday September 19 2014, @12:43PM
I'd expepct you can download a signed .deb and check the signature manually, which might make it safer.
Registered IRC nick on chat.soylentnews.org: qkontinuum
(Score: 2) by _NSAKEY on Friday September 19 2014, @04:59PM
The steps for doing that can be found here [debian.org]
(Score: -1, Offtopic) by Anonymous Coward on Friday September 19 2014, @11:29AM
What solutions exists for beyond really paranoids? Like, for those imaginarilly paranoids? Or quaternionly paranoids?
(Score: 2) by cosurgi on Friday September 19 2014, @03:25PM
If you are in any doubt that your system might have been hijacked with malicious binaries, after updating apt do this:
debsums > result
cat result | grep -v OK
#
#\ @ ? [adom.de] Colonize Mars [kozicki.pl]
#
(Score: 1, Insightful) by Anonymous Coward on Friday September 19 2014, @05:01PM
So if you really want to know whether your system has been hijacked with malicious binaries, what you have to do is mount your drive on a known safe computer then do the checks using clean stuff.
(Score: 2) by cosurgi on Monday September 22 2014, @09:44AM
right, you would need to reinstall debsums first from clean source. Or, as you say go to another safe computer.
#
#\ @ ? [adom.de] Colonize Mars [kozicki.pl]
#
(Score: 1) by Freebirth Toad on Sunday September 21 2014, @05:02PM