{"id":184170,"date":"2026-11-06T23:40:44","date_gmt":"2026-11-06T21:40:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-paketnom-menedzhere-apt-pozvolyayushhaya-sovershit-mitm-ataku-dlya-polucheniya-prav-root"},"modified":"2026-11-06T23:40:54","modified_gmt":"2026-11-06T21:40:54","slug":"apt-package-manager-vulnerability-allows-attackers-to-gain-root-privileges-via-mitm-attacks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/apt-package-manager-vulnerability-allows-attackers-to-gain-root-privileges-via-mitm-attacks","title":{"rendered":"Vulnerability in the APT package manager allowing a MITM attack to gain root privileges","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Correction releases for the APT package management tool have been published, addressing a vulnerability (CVE-2026-109518) that allows bypassing checks during file downloads and executing arbitrary code with root privileges. A total of 13 releases have been issued, covering all APT branches created over the last 10 years, starting from 1.2.x. Package updates fixing the vulnerability have also been created for various versions of Debian, Ubuntu, and Deepin. By default, the issue affects all releases starting from Debian 12 and Ubuntu 22.04. Exploiting older versions is possible by setting the Acquire::Retries parameter to a value greater than 0.<\/p>\n
An attacker capable of intercepting HTTP traffic between the user and the package repository during package installation can install a modified, unverified version of the package, allowing them to gain root privileges on the system. The attack can be conducted, for example, through the compromise of mirrors, proxy servers, wireless access points, or provider gateways. The vulnerability report does not mention specific details, stating only that the problem is due to improper handling of hard links. Based on the patch where opening the file with the FileFd::Empty (O_TRUNC) flag is replaced with FileFd::Exclusive (O_EXCL), during the resumption of an interrupted download, the attacker could overwrite data that had already been hashed during the initial download. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"