4

CVE-2014-0478

Exploit
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Advanced Package Tool Version <= 1.0.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.57% 0.721
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4 4.9 4.9
AV:N/AC:H/Au:N/C:N/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/58843
http://secunia.com/advisories/59358
http://www.debian.org/security/2014/dsa-2958
http://www.ubuntu.com/usn/USN-2246-1
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795
Exploit