CVE-2009-1358: Critical severity kali linux package management (apt) vulnerability
Published Apr 21, 2009
·Updated
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
Affected Software
180 affected components
Debian Apt=0.7.5
Debian Apt=0.3.12
Debian Apt=0.5.28
Debian Apt=0.7.7
Debian Apt=0.6.12
Debian Apt=0.3.13
Debian Apt=0.6.14
Debian Apt=0.6.27-ubuntu3
Debian Apt=0.7.6
Debian Apt=0.6.46.3-0.1
Debian Apt=0.1.5
Debian Apt=0.0.13-bo1
Debian Apt=0.5.8
Debian Apt=0.6.17
Debian Apt=0.6.1
Debian Apt=0.6.43.3
Debian Apt=0.0.10
Debian Apt=0.6.36
Debian Apt=0.6.10
Debian Apt=0.3.3
Debian Apt=0.6.42
Debian Apt=0.6.11
Debian Apt=0.3.2
Debian Apt=0.5.21
Debian Apt=0.6.3
Debian Apt=0.6.15
Debian Apt=0.6.42.2
Debian Apt=0.6.18
Debian Apt=0.5.5.1
Debian Apt=0.5.30
Debian Apt=0.1.7
Debian Apt=0.7.4
Debian Apt=0.5.2
Debian Apt=0.0.1
Debian Apt=0.3.16
Debian Apt=0.6.44
Debian Apt=0.6.0
Debian Apt=0.5.22
Debian Apt=0.6.29
Debian Apt=0.0.16-1
Debian Apt=0.6.46.3-0.2
Debian Apt=0.5.12
Debian Apt=0.0.2
Debian Apt=0.5.11
Debian Apt=0.6.45
Debian Apt=0.6.40
Debian Apt=0.6.39
Debian Apt=0.5.14
Debian Apt=0.0.11
Debian Apt=0.3.14
Debian Apt=0.3.4
Debian Apt=0.6.46.1
Debian Apt=0.6.22
Debian Apt=0.6.27
Debian Apt=0.6.27-ubuntu2
Debian Apt=0.6.6
Debian Apt=0.6.40.1
Debian Apt=0.3.15
Debian Apt=0.5.30-ubuntu2
Debian Apt=0.6.42.3
Debian Apt=0.6.5
Debian Apt=0.0.17-1
Debian Apt=0.0.13
Debian Apt=0.3.0
Debian Apt=0.0.5
Debian Apt=0.6.24
Debian Apt=0.6.2
Debian Apt=0.6.43
Debian Apt=0.6.33
Debian Apt=0.0.15
Debian Apt=0.0.15-0.2bo
Debian Apt=0.0.8
Debian Apt=0.6.8
Debian Apt=0.6.28
Debian Apt=0.3.9
Debian Apt=0.0.7
Debian Apt=0.6.44.2-exp1
Debian Apt=0.6.44.1
Debian Apt=0.6.46.4-0.1
Debian Apt=0.5.13
Debian Apt=0.7.9
Debian Apt=0.5.29
Debian Apt=0.5.5
Debian Apt=0.6.31
Debian Apt=0.6.27-ubuntu4
Debian Apt=0.6.34
Debian Apt=0.6.37
Debian Apt=0.5.25
Debian Apt=0.1.9
Debian Apt=0.6.21
Debian Apt=0.6.46.2
Debian Apt=0.5.17
Debian Apt=0.7.3
Debian Apt=0.0.12
Debian Apt=0.1.6
Debian Apt=0.6.43.1
Debian Apt=0.1.1
Debian Apt=0.5.24
Debian Apt=0.5.3
Debian Apt=0.5.1
Debian Apt=0.0.15-0.1bo
Debian Apt=0.5.27
Debian Apt=0.5.30-ubuntu1
Debian Apt=0.3.17
Debian Apt=0.6.30
Debian Apt=0.6.7
Debian Apt=0.5.18
Debian Apt=0.0.4
Debian Apt=0.5.0
Debian Apt=0.5.19
Debian Apt=0.6.44.1-0.1
Debian Apt=0.3.6
Debian Apt=0.3.11
Debian Apt=0.5.7
Debian Apt=0.6.42.1
Debian Apt=0.6.23
Debian Apt=0.6.32
Debian Apt=0.6.19
Debian Apt=0.0.14
Debian Apt=0.1
Debian Apt=0.5.20
Debian Apt=0.5.15
Debian Apt=0.5.9
Debian Apt=0.6.16
Debian Apt=0.3.18
Debian Apt=0.6.46
Debian Apt=0.5.6
Debian Apt=0.6.41
Debian Apt=0.5.23
Debian Apt=0.6.20
Debian Apt=0.6.44.2
Debian Apt=0.6.38
Debian Apt=0.0.6
Debian Apt=0.5.4
Debian Apt=0.5.10
Debian Apt=0.7.8
Debian Apt=0.6.27-ubuntu1
Debian Apt=0.6.9
Debian Apt=0.6.43.2
Debian Apt=0.0.3
Debian Apt=0.5.16
Debian Apt=0.6.4
Debian Apt=0.6.35
Debian Apt=0.6.25
Debian Apt=0.3.7
Debian Apt=0.6.13
Debian Apt=0.6.46.3
Debian Apt=0.5.32
Debian Apt=0.1.3
Debian Apt=0.5.31
Debian Apt=0.5.26
Debian Apt=0.3.19
Debian Apt=0.3.1
Debian Apt=0.0.9
Debian Apt=0.6.36-ubuntu1
Debian Advanced Package Tool=0.7.0
Debian Advanced Package Tool=0.7.1
Debian Advanced Package Tool=0.7.2
Debian Advanced Package Tool=0.7.2-0.1
Debian Advanced Package Tool=0.7.10
Debian Advanced Package Tool=0.7.11
Debian Advanced Package Tool=0.7.12
Debian Advanced Package Tool=0.7.13
Debian Advanced Package Tool=0.7.14
Debian Advanced Package Tool=0.7.15-exp1
Debian Advanced Package Tool=0.7.15-exp2
Debian Advanced Package Tool=0.7.15
Debian Advanced Package Tool=0.7.15-exp3
Debian Advanced Package Tool=0.7.16
Debian Advanced Package Tool=0.7.17-exp1
Debian Advanced Package Tool=0.7.17-exp2
Debian Advanced Package Tool=0.7.17-exp3
Debian Advanced Package Tool=0.7.17
Debian Advanced Package Tool=0.7.17-exp4
Debian Advanced Package Tool=0.7.18
Debian Advanced Package Tool=0.7.19
Debian Advanced Package Tool<=0.7.20
Debian Advanced Package Tool=0.7.20.1
Debian Advanced Package Tool=0.7.20.2
Debian Advanced Package Tool=0.7.21
Event History
Apr 21, 2009
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-1358?
CVE-2009-1358 has been classified as a critical severity vulnerability due to the possibility of remote code execution via malicious repositories.
2
How do I fix CVE-2009-1358?
To fix CVE-2009-1358, upgrade the apt package to version 0.7.21 or later.
3
What systems are affected by CVE-2009-1358?
CVE-2009-1358 affects Debian's Advanced Package Tool (apt) versions before 0.7.21.
4
What kind of attack does CVE-2009-1358 enable?
CVE-2009-1358 allows attackers to exploit the vulnerability by tricking apt into accepting invalid signed repositories.
5
Is CVE-2009-1358 an easy vulnerability to exploit?
Yes, CVE-2009-1358 can be easily exploited by remote attackers if the vulnerable version of apt is in use.