« Volver al listado

CVE-2012-0214

Estado: ModificadaMedia (4.3)—

The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Advanced Package Tool — Advanced Package Tool

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-0214",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-04-15T23:55:08.313",
  "references": [
    {
      "url": "http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=b7a6594d1e5ed199a7a472b78b33e070375d6f92",
      "source": "security@debian.org"
    },
    {
      "url": "http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1385-1",
      "source": "security@debian.org"
    },
    {
      "url": "http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=b7a6594d1e5ed199a7a472b78b33e070375d6f92",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://anonscm.debian.org/gitweb/?p=apt/apt.git%3Ba=commitdiff%3Bh=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1385-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned."
    },
    {
      "lang": "es",
      "value": "El método pkgAcqMetaClearSig::Failed en apt-pkg/acquire-item.cc en Advanced Package Tool (APT) 0.8.11 hasta 0.8.15.10 y 0.8.16 anterior a 0.8.16~exp13, cuando actualizando desde repositorios que utilizan ficheros lnRelease, permite a atacantes man-in-the-middle instalar paquetes arbitrarios previniendo al usuario de descargar el nuevo fichero InRelease, el cual deja el fichero InRelease original activo y hace más difícil detectar que el fichero Packages está modificado y no firmado."
    }
  ],
  "lastModified": "2026-06-16T23:36:54.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:advanced_package_tool:advanced_package_tool:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0976AA44-B36F-4023-966F-206946FC3823",
              "versionEndIncluding": "0.8.16\\~exp12"
            },
            {
              "criteria": "cpe:2.3:a:advanced_package_tool:advanced_package_tool:0.8.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "717AAEBC-858E-447A-8BDD-90C6E5F384D6"
            },
            {
              "criteria": "cpe:2.3:a:advanced_package_tool:advanced_package_tool:0.8.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03FCE192-4EAF-4A63-B6F7-E9409384C7DC"
            },
            {
              "criteria": "cpe:2.3:a:advanced_package_tool:advanced_package_tool:0.8.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A881068-FFCF-4AA1-90D6-84B64E721D4A"
            },
            {
              "criteria": "cpe:2.3:a:advanced_package_tool:advanced_package_tool:0.8.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E46DE4C7-33E9-4828-8F86-51BFA0677C9B"
            },
            {
              "criteria": "cpe:2.3:a:advanced_package_tool:advanced_package_tool:0.8.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB46FF4B-BCB4-47C1-ACAE-ED986AE8FB2A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}