Cloudanix VulnDB

CVE-2018-0501

Medium · 5.9

CVSS

5.9

EPSS

1.0%

Published

Aug 21, 2018

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how update tools verify security signatures from backup download servers could let attackers slip bad software onto computers during routine updates.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Tampering
Component
Application
Class
Cryptographic Weakness
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The mirror:// method in APT mishandles GPG signature verification for the InRelease file when falling back to an alternate mirror, allowing an attacker-controlled mirror to supply unsigned or incorrectly signed metadata.

Why it matters to the business

Systems relying on package updates from mirrors could receive and install altered package lists or malicious packages, leading to software supply-chain compromise and potential full system takeover.

How an attack unfolds

An attacker deploys a malicious mirror server containing a crafted InRelease file; when the primary mirror becomes unavailable, APT falls back to the attacker mirror and skips proper signature verification, accepting the malicious metadata and subsequently fetching attacker-supplied packages.

How to fix it

Upgrade APT to 1.6.4 or newer for the 1.6.x series and to 1.7.0~alpha3 or newer for the 1.7.x series; for the affected rsync.git component apply commit 2b7e9042b631fef022410b3236d762d097c172fd.

How to confirm the fix worked

Confirm the installed APT version meets or exceeds the fixed releases and test mirror failover behavior with a signed InRelease file on the fallback mirror.

Typical attack path

  1. Position a malicious mirror in the APT sources list or as a fallback
  2. Induce or wait for primary mirror failure
  3. Serve an unsigned or forged InRelease file from the fallback mirror
  4. APT accepts the metadata without verification
  5. Deliver and install malicious packages via the poisoned repository

How to detect it

Review APT history and log files for mirror fallback events, unexpected InRelease fetches, and package installations from non-standard mirrors around the time of exposure.

What your security team should do

  • Apply the listed APT upgrades across all affected systems immediately
  • Audit APT sources configuration to minimize reliance on untrusted fallback mirrors
  • Monitor package installation logs for unexpected repository changes

The record

The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 apt 0 1.6.4
Debian:12 apt 0 1.6.4
Debian:13 apt 0 1.6.4
Ubuntu:18.04:LTS apt 0 1.6.3ubuntu0.1

Related vulnerabilities