News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in apt/apt-get. Parent comment

Re:Remote code execution vulnerability in apt/apt-get by tracker1 on Tuesday January 22, 2019 @02:39PM (#18971628)
And overcoming both is much harder than overcoming either on their own.
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by moviuro on Tuesday January 22, 2019 @02:46PM (#18971699)
In the worst case, you only need to overcome one. And you ~double your attack surface.
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by tracker1 on Tuesday January 22, 2019 @06:14PM (#18973718)
Which one? If you gain control of a server, you'd still have to overcome signing... and you only control that single server, not all replicas (for a bug like in TFA).

Could you describe a way to have double the attack surface that would effect the majority of peer servers?

[ Parent | on HN ]