APT mishandles hard links allowing remote code execution
Original title: USN-8996-1: APT vulnerability
A remote on-path attacker can trick APT into installing an unverified package and achieve root-level remote code execution.
Ubuntu Security Notice USN-8996-1 describes a flaw where APT incorrectly handles hard links during redirects and retrying package downloads. This could allow a remote on-path attacker to force installation of an unverified package, resulting in remote code execution with root privileges. No fixed version is stated.
Impact: remote code execution with root privileges
From the original article
Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.