Re:Debian apt security update: man-in-the-middle arbitrary c...
by tremon on Wednesday November 04, 2026 @10:16AM
(#50366779)
> it should be "download from source" (of any type, remember that http(s) isn't only way) -> put into temporary dir -> validate, regardless of source used
This is what apt already does. The problem is that a malevolent source can see a client downloading package #1, then on seeing a request for package #2 it issues a redirect to a doctored package #1 and because apt stores files based on the remote name and not the requested name, it will overwrite already-downloaded package #1. The validation fails on downloaded package #2 but apt doesn't abort the install process, it simply skips it (and any dependencies) and continues to install the downloaded and previously-validated package #1.
There's plenty of ways to solve this, and none are obvious if you are unaware of this attack vector:
a) use per-package tempdir instead of per-source: no obvious benefit
b) use request package name instead of remote url filename: it would be dangerous for apt to assume that it knows better than a package mirror what the expected filename for a package is (it's strictly defined by Debian policy)
c) immediately delete downloaded package if validation fails: obstructs problem analysis and digital forensics
d) abort install process if a package fails validation: reduces resilience in the face of network errors (e.g. if the mirror is in the process of updating itself)
This is what apt already does. The problem is that a malevolent source can see a client downloading package #1, then on seeing a request for package #2 it issues a redirect to a doctored package #1 and because apt stores files based on the remote name and not the requested name, it will overwrite already-downloaded package #1. The validation fails on downloaded package #2 but apt doesn't abort the install process, it simply skips it (and any dependencies) and continues to install the downloaded and previously-validated package #1.
There's plenty of ways to solve this, and none are obvious if you are unaware of this attack vector:
a) use per-package tempdir instead of per-source: no obvious benefit
b) use request package name instead of remote url filename: it would be dangerous for apt to assume that it knows better than a package mirror what the expected filename for a package is (it's strictly defined by Debian policy)
c) immediately delete downloaded package if validation fails: obstructs problem analysis and digital forensics
d) abort install process if a package fails validation: reduces resilience in the face of network errors (e.g. if the mirror is in the process of updating itself)