Lucene search

DebianCVE-2016-1252

HistoryDec 05, 2017 - 4:29 p.m.

CVE-2016-1252

2017-12-0516:29:00

CWE-295

debian

web.nvd.nist.gov

110

cve-2016-1252

apt package

debian

ubuntu

man-in-the-middle attack

repository-signing

inrelease file signatures

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.7

Confidence

High

EPSS

0.014

Percentile

86.2%

JSON

The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.

Affected configurations

Nvd

Node

debianadvanced_package_toolRange<1.0.9.8.4

AND

debiandebian_linuxMatch8.0

Node

canonicalubuntu_linuxMatch14.04esm

canonicalubuntu_linuxMatch16.04lts

canonicalubuntu_linuxMatch16.10

VendorProductVersionCPE
debianadvanced_package_tool*cpe:2.3:a:debian:advanced_package_tool:*:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
canonicalubuntu_linux16.10cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
debian	advanced_package_tool	*	cpe:2.3:a:debian:advanced_package_tool::::::::
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
canonical	ubuntu_linux	14.04	cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
canonical	ubuntu_linux	16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
canonical	ubuntu_linux	16.10	cpe:2.3:o:canonical:ubuntu_linux:16.10:::::::*