CVE-2014-0489

High

Published: 03/11/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

APT versions before 1.0.9, when the Acquire::GzipIndexes option is enabled, do not validate checksums, allowing remote attackers to execute arbitrary code via a crafted package.

Risk Assessment

The lack of checksum validation poses a serious security risk, enabling remote code execution by unauthorized individuals.

Recommendation

It is recommended to upgrade APT to version 1.0.9 or later to mitigate this vulnerability.

Other vulnerabilities in APT

CVE-2014-0487High
APT versions before 1.0.9 do not verify downloaded files if they have been modified as indicated by the If-Modified-Since header. This can lead to unspecified impacts and attack vectors.

Original NVD description (English source)

APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.