APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

It was discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files.

It was discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files.

For Debian 9 stretch, this problem has been fixed in version 1.4.11.

We recommend that you upgrade your apt packages.

For the detailed security status of apt please refer to its security tracker page at: https://security-tracker.debian.org/tracker/apt

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4667-1 advisory.

    Kevin Backhouse discovered that APT incorrectly handled certain packages. A local attacker could possibly     use this issue to cause APT to crash or stop responding, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
144043	Debian DSA-4808-1 : apt - security update	Nessus	Debian Local Security Checks	medium
144029	Debian DLA-2487-1 : apt security update	Nessus	Debian Local Security Checks	medium
144013	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : APT vulnerability (USN-4667-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2020-27350

critical

Tenable Plugins

medium

medium

critical