Debian and Ubuntu APT flaw lets attackers swap verified packages and run code as root
VULNERABILITYAPTredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A flaw in APT allows a man-in-the-middle attacker who can alter package downloads to replace a checked package with a malicious one, with the payload executing as root. Exploitation requires APT to retry failed downloads, which the article says is the default from Debian 12 onwards (the list is cut off). No CVE identifiers or fixed package versions appear in the available text. Defenders should apply the APT updates named in the Debian, Ubuntu and APT developer advisories published on 4 November and review network paths used for package retrieval.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check which Debian and Ubuntu hosts use APT's retry behaviour for package downloads, starting with Debian 12.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News