Ubuntu warns of APT flaw that could allow root code execution via hard links
VULNERABILITYAPTredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Ubuntu notice USN-8996-1 covers an APT vulnerability in how the package manager handles hard links when following redirects and retrying package downloads. A remote on-path attacker could possibly abuse this to trick APT into installing an unverified package, leading to remote code execution as root. The supplied text lists no CVE identifier and no affected or fixed package versions. Defenders should apply the APT update from the referenced Ubuntu security notice on all affected hosts, and check the notice for version details and CVE mapping.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Install the APT security update referenced in Ubuntu notice USN-8996-1 on Ubuntu systems.
- Check the Ubuntu notice for the affected and fixed APT versions before deciding which systems to prioritise.
Written by AI from the sources, checked against them
Full story timeline · 1 update
- Wed 4 NovemberUSN-8996-1: APT vulnerabilityUbuntu Security Notices
Who reported · 1 outlet
Ubuntu Security Notices