CVE-2012-3587 APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers...
LowCVSS 2.6
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apt(Debian:12) | < 0.7.25 | 0.7.25 |
| debian/apt(Debian:13) | < 0.7.25 | 0.7.25 |
| debian/apt(Debian:14) | < 0.7.25 | 0.7.25 |
| debian advanced package tool | = 0.7.0 | No fix listed |
| debian advanced package tool | = 0.7.1 | No fix listed |
| debian advanced package tool | = 0.7.2 | No fix listed |
| debian advanced package tool | = 0.7.2-0.1 | No fix listed |
| debian advanced package tool | = 0.7.10 | No fix listed |
| debian advanced package tool | = 0.7.11 | No fix listed |
| debian advanced package tool | = 0.7.12 | No fix listed |
| debian advanced package tool | = 0.7.13 | No fix listed |
| debian advanced package tool | = 0.7.14 | No fix listed |
| debian advanced package tool | = 0.7.15 | No fix listed |
| debian advanced package tool | = 0.7.15-exp1 | No fix listed |
| debian advanced package tool | = 0.7.15-exp2 | No fix listed |
| debian advanced package tool | = 0.7.15-exp3 | No fix listed |
| debian advanced package tool | = 0.7.16 | No fix listed |
| debian advanced package tool | = 0.7.17 | No fix listed |
| debian advanced package tool | = 0.7.17-exp1 | No fix listed |
| debian advanced package tool | = 0.7.17-exp2 | No fix listed |
| debian advanced package tool | = 0.7.17-exp3 | No fix listed |
| debian advanced package tool | = 0.7.17-exp4 | No fix listed |
| debian advanced package tool | = 0.7.18 | No fix listed |
| debian advanced package tool | = 0.7.19 | No fix listed |
| debian advanced package tool | = 0.7.20 | No fix listed |
Show 39 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian advanced package tool | = 0.7.20.1 | No fix listed |
| debian advanced package tool | = 0.7.20.2 | No fix listed |
| debian advanced package tool | = 0.7.21 | No fix listed |
| debian advanced package tool | = 0.7.22 | No fix listed |
| debian advanced package tool | = 0.7.22.1 | No fix listed |
| debian advanced package tool | = 0.7.22.2 | No fix listed |
| debian advanced package tool | = 0.7.23 | No fix listed |
| debian advanced package tool | = 0.7.23.1 | No fix listed |
| debian advanced package tool | = 0.7.24 | No fix listed |
| debian advanced package tool | = 0.8.0 | No fix listed |
| debian advanced package tool | = 0.8.0-pre1 | No fix listed |
| debian advanced package tool | = 0.8.0-pre2 | No fix listed |
| debian advanced package tool | = 0.8.1 | No fix listed |
| debian advanced package tool | = 0.8.10 | No fix listed |
| debian advanced package tool | = 0.8.10.1 | No fix listed |
| debian advanced package tool | = 0.8.10.2 | No fix listed |
| debian advanced package tool | = 0.8.10.3 | No fix listed |
| debian advanced package tool | = 0.8.11 | No fix listed |
| debian advanced package tool | = 0.8.11.1 | No fix listed |
| debian advanced package tool | = 0.8.11.2 | No fix listed |
| debian advanced package tool | = 0.8.11.3 | No fix listed |
| debian advanced package tool | = 0.8.11.4 | No fix listed |
| debian advanced package tool | = 0.8.11.5 | No fix listed |
| debian advanced package tool | = 0.8.12 | No fix listed |
| debian advanced package tool | = 0.8.13 | No fix listed |
| debian advanced package tool | = 0.8.13.1 | No fix listed |
| debian advanced package tool | = 0.8.13.2 | No fix listed |
| debian advanced package tool | = 0.8.14 | No fix listed |
| debian advanced package tool | = 0.8.14.1 | No fix listed |
| debian advanced package tool | = 0.8.15 | No fix listed |
| debian advanced package tool | = 0.8.15-exp1 | No fix listed |
| debian advanced package tool | = 0.8.15-exp2 | No fix listed |
| debian advanced package tool | = 0.8.15-exp3 | No fix listed |
| debian advanced package tool | = 0.8.15.1 | No fix listed |
| debian advanced package tool | = 0.8.15.6 | No fix listed |
| debian advanced package tool | = 0.8.15.7 | No fix listed |
| debian advanced package tool | = 0.8.15.8 | No fix listed |
| debian advanced package tool | = 0.8.15.9 | No fix listed |
| debian advanced package tool | = 0.8.15.10 | No fix listed |
References
- Debian Security Tracker CVE-2012-3587 vendor-advisory
- 20120612 Strange gpg key shadowing mailing-list
- USN-1475-1 vendor-advisory
- USN-1477-1 vendor-advisory
- bugs.launchpad.net