Bug 747658 (CVE-2011-3634) - CVE-2011-3634 apt: Did not honor Verify-Host configuration option properly
Summary: CVE-2011-3634 apt: Did not honor Verify-Host configuration option properly
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2011-3634
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-10-20 16:14 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:48 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-20 16:16:07 UTC
Embargoed:

Attachments (Terms of Use)

Description Jan Lieskovsky 2011-10-20 16:14:45 UTC 
It was reported that apt, Advanced Packaging Tool, did not honor the Verify-Host configuration option properly, when the x509 certificate host name did not match. A remote attacker could provide a specially-crafted APT repository URL and trick the local unsuspecting user into using it, potentially leading successful MITM attack.

References:
[1] https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353
[2] http://www.openwall.com/lists/oss-security/2011/10/19/4
    (CVE request)

Upstream patch:
[3] http://bazaar.launchpad.net/~donkult/apt/sid/revision/2053.1.28
Comment 1 Jan Lieskovsky 2011-10-20 16:16:07 UTC 
This issue did NOT affect the versions of the apt package, as shipped with Fedora release of 14 and 15, since those versions do NOT support apt-https method yet.
Comment 2 Jan Lieskovsky 2011-10-21 13:07:58 UTC 
The CVE identifier of CVE-2011-3634 has been assigned to this issue:
[4] http://www.openwall.com/lists/oss-security/2011/10/20/12
Note You need to log in before you can comment on or make changes to this bug.