Debian apt security update (man-in-the-middle)

6 comments

• justicz 25 minutes ago
  I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.

  [0] https://x.com/just1cz/status/2118009777922228361

  [-]
  • sczi 5 minutes ago
    Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

      apt -o Acquire::http::AllowRedirect=false update
      apt -o Acquire::http::AllowRedirect=false upgrade
    

    Since this also involves redirects, would that protect users while updating apt for this one also?
  • justicz 22 minutes ago
    Speaking of which… if any of y’all work on security at OpenAI I have some questions for you about Daybreak! Please email me
• SoftTalker 17 minutes ago
  How would an attacker inject a redirect into an apt package download?
  [-]
  • mikepurvis 11 minutes ago
    MITM on the network, I guess like DNS takeover or the like.

    So you pass through the upstream headers but then simulate a failure/resume and supply different contents for the resumed download.

    [-]
    • SoftTalker 5 minutes ago
      So apt doesn't verify signatures on what is actually downloaded?
  • jxie2004 9 minutes ago
    [flagged]
• 8organicbits 1 hour ago
  I feel like they should release manual update instructions since the update mechanism is vulnerable. Although I see my systems already updated via unattended upgrades.

  edit: On lobste.rs I see a recommendation for `apt download`: https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_executi...
• thewisenerd 1 hour ago
  dupe (2h ago): https://news.ycombinator.com/item?id=50364814
• opengrass 1 hour ago
  [flagged]
  [-]
  • klez 38 minutes ago
    I'm pretty sure apt is written in C++. Am I remembering wrong?
    [-]
    • Palomides 33 minutes ago
      parts of apt are being redone in rust, but anyway this seems to be a logic bug (in c++ code)