[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: not getting compromised while applying apt-get upgrade for CVE-2016-1252

Idézem/Quoting Geert Stappers <stappers@stappers.nl>:

On Thu, Dec 15, 2016 at 09:43:59PM +0100, SZÉPE Viktor wrote:
Quoting Patrick Schleizer <adrelanos@riseup.net>:

>Very short summary of the bug:
>(my own words) During apt-get upgrading signature verification can be
>tricked resulting in arbitrary package installation, system compromise.
>- https://security-tracker.debian.org/tracker/CVE-2016-1252
>- https://www.debian.org/security/2016/dsa-3733
>- https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467
>How to upgrade from the insecure apt-get version to the
>patched apt-get version without being compromised during that

You may download the new package
(for amd64)

By the command

wget http://security.debian.org/debian-security/pool/updates/main/a/apt/apt_1.

and check its checksum

$ sha256sum apt_1.


Then the acual install

sudo dpkg --install apt_1.

Which might yield (due my test on a non-up-to-date-system)

(Reading database ... 42686 files and directories currently installed.)
Preparing to replace apt (using apt_1. ...
Unpacking replacement apt ...
dpkg: dependency problems prevent configuration of apt:
 apt depends on libapt-pkg4.12 (>=; however:
  Version of libapt-pkg4.12:amd64 on system is
 apt depends on libc6 (>= 2.15); however:
  Version of libc6:amd64 on system is 2.13-38+deb7u8.
 apt depends on libstdc++6 (>= 4.9); however:
  Version of libstdc++6:amd64 on system is 4.7.2-5.

dpkg: error processing apt (--install):
 dependency problems - leaving unconfigured
Processing triggers for man-db ...
Errors were encountered while processing:

 Version of libc6:amd64 on system is 2.13-38+deb7u8.

Excuse me. I though you are using jessie.

Please download the version for wheezy.

All the best!

SZÉPE Viktor
+36-20-4242498  sms@szepe.net  skype: szepe.viktor
Budapest, III. kerület

Reply to: