Apt security update

https://lists.debian.org/debian-security-announce/2014/msg00138.html

by TimWolla • 12 years ago

30 16 12 years ago

lists.debian.org

Seems ironic their cert doesnt match and I get a browser warning. What happened to Debian? Is Security something they have only heard about in folklore terms?

Alupis2• 12 years ago

Works fine for me. What browser are you using?

chimeracoder• 12 years ago

What browser are you using? I'm running Debian and it looks fine in Iceweasel.

throwaway5583• 12 years ago

The cert validates for me on firefox on windows as well as iceweasel on debian.

I don't think debian is any less secure than other OSs.

TheHippo• 12 years ago

Looks fine: https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian....

hadoukenio3• 12 years ago

What about it? That's the URL for the Debian mailing list and not where packages are downloaded from.

In fact, you download packages from Debian mirrors and most of these are over HTTP and not HTTPS. How do you know you're not downloading a compromised APT? Checksums you say? Don't forget you downloaded the package footprints via HTTP too!

The MITM for APT is the elephant in the room here.

Alupis2• 12 years ago

This seems like a relatively low impact security problem. I can't recall the last time I used a package manager to get a package's source.

(Usually when I want the source it's because I'm compiling a package from source, and I get the tarball from the project's website)

mcpherrinm• 12 years ago

The usual case for this is when there are patches applied by the distribution.

It's also more likely to work out of the box without having to hunt for build dependencies.

This is mostly useful when you care about contributing bugfixes to the distro patches, or you can't get the upstream source to build easily.

stevekemp• 12 years ago

I audit software, so frequently I'll pick targets on my Debian system(s) and run:

    apt-get source $foo

That gives me all the source to read, and is something I do at least once a week.

pflanze• 12 years ago

I often recompile packages from testing or unstable on stable, to get newer versions, or because I need to patch something. This is usually more productive than installing from upstream source. (Exceptions are packages with a big tree of dependencies, where chances are high that something won't build.)

More often than not, I'm checking the source package signautures (gpg) myself, though, because in the past doing it automatically wouldn't work or so. I wonder whether those signatures are concerned in this bug. I've tried to get at the source repo, but no luck (stable has a bzr repo that redirects to a 404, another url nearby does not contain recent changes; sid is in Git, but doesn't appear to have changes related to the bug). In the end I diffed the source of the apt package against its former version, I've put the diff here:

http://christianjaeger.ch/scratch/apt-0.9.7.9+deb7u1_apt-0.9...

I haven't studied it enough to get the answer (yet).

Edit: it seems this really concerns repository signatures only, not package signatures; assuming that you're verifying that the package signature (the one in the *.dsc file) is correct and the hash sums match the package files, the only possible attack will be to refuse access to the correct/latest version of the package.

Edit 2: but as the bug report points out, the .dsc signature check can't be relied on automatically (even if the check fails, apt returns success, you have to read the stdout/stderr instead). https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795

So the only way to have been safe was to check every apt-source'd package individually, with manual eyeing or running of gpg.

And, this bit (from the bug report) may be most worrysome: "(..) all debian build systems which probably rely on secure APT." (i.e. the binary packages may have been built automatically based on source that was fetched without protection).

Apt security update

Related Stories