CVE-2014-4510: CSRF
First published: Sat Jun 21 2014(Updated: )
As noted in this report to oss-security [1], a flaw exists in the apt-cacher-ng server, and an inside attacker (on the LAN with knowledge of the server's address), could trick a user into visiting, or redirect them to, a manipulated URL that would cause the cross-site scripting attack. A proposed fix has been made [2]. [1] <a href="http://seclists.org/oss-sec/2014/q2/602">http://seclists.org/oss-sec/2014/q2/602</a> [2] <a href="http://anonscm.debian.org/gitweb/?p=apt-cacher-ng/apt-cacher-ng.git;a=commitdiff;h=6f08e6a3995d1bed4e837889a3945b6dc650f6ad">http://anonscm.debian.org/gitweb/?p=apt-cacher-ng/apt-cacher-ng.git;a=commitdiff;h=6f08e6a3995d1bed4e837889a3945b6dc650f6ad</a>
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Debian Apt-cacher | =0.7.26 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://anonscm.debian.org/cgit/apt-cacher-ng/apt-cacher-ng.git/diff/?id=6f08e6a3995d1bed4e837889a3945b6dc650f6ad
- http://seclists.org/oss-sec/2014/q2/602
- http://seclists.org/oss-sec/2014/q2/603
- http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-misc/apt-cacher-ng/files/apt-cacher-ng-0.7.26-CVE-2014-4510.patch?view=markup
- http://www.securityfocus.com/bid/68136
- https://bugzilla.redhat.com/show_bug.cgi?id=1111807
- http://anonscm.debian.org/gitweb/?p=apt-cacher-ng/apt-cacher-ng.git;a=commitdiff;h=6f08e6a3995d1bed4e837889a3945b6dc650f6ad
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1111808
- https://access.redhat.com/security/cve/CVE-2014-4510
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-4510
- agent/references
- agent/severity
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/trending
- vendor/debian
- canonical/debian apt-cacher
- version/debian apt-cacher/0.7.26