CVE-2012-0954 Security feature bypass in n/a
Remote attackers can install altered packages via MITM attacks when apt-key net-update is used, bypassing GPG subkey checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-0954?
CVE-2012-0954 is a low-severity vulnerability in n/a, published on 19 Jun 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.
Weakness: CWE-20
Which versions are affected by CVE-2012-0954?
It affects 1 product.
Products include Debian Advanced Package Tool.
How do I fix CVE-2012-0954?
Upgrade to a fixed version.
Is CVE-2012-0954 being exploited?
There is no known exploitation of CVE-2012-0954 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2012-0954, GHSA-86m4-88r3-mw4c.