CVE-2013-1051 — MEDIUM (4.3)

Vulnerability Description

apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.

CVSS Score

4.3

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Debian	Advanced Package Tool	0.8.16
Debian	Apt	0.9.7
Canonical	Ubuntu Linux	11.10

Related Weaknesses (CWE)

CWE-20

References

http://osvdb.org/91428
http://secunia.com/advisories/52633Vendor Advisory
http://www.ubuntu.com/usn/USN-1762-1
http://osvdb.org/91428
http://secunia.com/advisories/52633Vendor Advisory
http://www.ubuntu.com/usn/USN-1762-1

FAQ

What is CVE-2013-1051?

CVE-2013-1051 is a vulnerability with a CVSS score of 4.3 (MEDIUM). apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly r...

How severe is CVE-2013-1051?

CVE-2013-1051 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-1051?

Check the references section above for vendor advisories and patch information. Affected products include: Debian Advanced Package Tool, Debian Apt, Canonical Ubuntu Linux.