{"action":"created","issue":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520","repository_url":"https://api.github.com/repos/QubesOS/qubes-issues","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520/labels{/name}","comments_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520/comments","events_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520/events","html_url":"https://github.com/QubesOS/qubes-issues/issues/2520","id":195828471,"number":2520,"title":"Debian, Whonix, Ubuntu - apt-get upgrading security issue CVE-2016-1252","user":{"login":"adrelanos","id":1985040,"avatar_url":"https://avatars.githubusercontent.com/u/1985040?v=3","gravatar_id":"","url":"https://api.github.com/users/adrelanos","html_url":"https://github.com/adrelanos","followers_url":"https://api.github.com/users/adrelanos/followers","following_url":"https://api.github.com/users/adrelanos/following{/other_user}","gists_url":"https://api.github.com/users/adrelanos/gists{/gist_id}","starred_url":"https://api.github.com/users/adrelanos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrelanos/subscriptions","organizations_url":"https://api.github.com/users/adrelanos/orgs","repos_url":"https://api.github.com/users/adrelanos/repos","events_url":"https://api.github.com/users/adrelanos/events{/privacy}","received_events_url":"https://api.github.com/users/adrelanos/received_events","type":"User","site_admin":false},"labels":[{"id":401292621,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/C:%20Debian","name":"C: Debian","color":"cccccc","default":false},{"id":354469647,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/C:%20Whonix","name":"C: Whonix","color":"cccccc","default":false},{"id":184545385,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/P:%20critical","name":"P: critical","color":"e11d21","default":false},{"id":420799633,"url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/security","name":"security","color":"000000","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/milestones/24","html_url":"https://github.com/QubesOS/qubes-issues/milestone/24","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/milestones/24/labels","id":2145500,"number":24,"title":"Release 3.2 updates","description":"Updates for stable release","creator":{"login":"marmarek","id":726704,"avatar_url":"https://avatars.githubusercontent.com/u/726704?v=3","gravatar_id":"","url":"https://api.github.com/users/marmarek","html_url":"https://github.com/marmarek","followers_url":"https://api.github.com/users/marmarek/followers","following_url":"https://api.github.com/users/marmarek/following{/other_user}","gists_url":"https://api.github.com/users/marmarek/gists{/gist_id}","starred_url":"https://api.github.com/users/marmarek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marmarek/subscriptions","organizations_url":"https://api.github.com/users/marmarek/orgs","repos_url":"https://api.github.com/users/marmarek/repos","events_url":"https://api.github.com/users/marmarek/events{/privacy}","received_events_url":"https://api.github.com/users/marmarek/received_events","type":"User","site_admin":false},"open_issues":93,"closed_issues":19,"state":"open","created_at":"2016-11-19T00:33:44Z","updated_at":"2016-12-15T16:43:26Z","due_on":null,"closed_at":null},"comments":16,"created_at":"2016-12-15T15:05:36Z","updated_at":"2016-12-16T21:40:46Z","closed_at":null,"body":"#### Qubes OS version (e.g., `R3.2`):\r\n\r\nall\r\n\r\n#### Affected TemplateVMs (e.g., `fedora-23`, if applicable):\r\n\r\nall Debian based templates, all Whonix templates [and Ubuntu templates]\r\n\r\n---\r\n\r\nVery short summary of the bug:\r\n(my own words) During apt-get upgrading signature verification can be tricked resulting in arbitrary package installation, template compromise.\r\n\r\nsources:\r\n\r\n* https://security-tracker.debian.org/tracker/CVE-2016-1252\r\n* https://www.debian.org/security/2016/dsa-3733\r\n* https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467\r\n* https://lists.debian.org/debian-security-announce/2016/msg00316.html\r\n\r\n(Specifically dangerous when upgrading over Tor. Slightly less dangerous when upgrading over onions mirrors [boils down to trust, i.e. IF the onion mirror is not compromised by that time].)\r\n\r\n---\r\n\r\nSuggested solution for downloadable Qubes templates:\r\nRebuild all templates. No changes besides building them with newer Debian packages (from jessie-security).\r\n\r\n---\r\n\r\nSolution for existing templates?\r\n\r\n* just have users upgrade them and hope they'll not be compromised during doing so?\r\n* some better solution to security upgrade templates? (perhaps manually downloading and verifying the patched apt-get package)\r\n* recommend to reinstall the template?\r\n* Release a Qubes Security Bulletin?"},"comment":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/comments/267702484","html_url":"https://github.com/QubesOS/qubes-issues/issues/2520#issuecomment-267702484","issue_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2520","id":267702484,"user":{"login":"adrelanos","id":1985040,"avatar_url":"https://avatars.githubusercontent.com/u/1985040?v=3","gravatar_id":"","url":"https://api.github.com/users/adrelanos","html_url":"https://github.com/adrelanos","followers_url":"https://api.github.com/users/adrelanos/followers","following_url":"https://api.github.com/users/adrelanos/following{/other_user}","gists_url":"https://api.github.com/users/adrelanos/gists{/gist_id}","starred_url":"https://api.github.com/users/adrelanos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrelanos/subscriptions","organizations_url":"https://api.github.com/users/adrelanos/orgs","repos_url":"https://api.github.com/users/adrelanos/repos","events_url":"https://api.github.com/users/adrelanos/events{/privacy}","received_events_url":"https://api.github.com/users/adrelanos/received_events","type":"User","site_admin":false},"created_at":"2016-12-16T21:40:46Z","updated_at":"2016-12-16T21:40:46Z","body":"Marek Marczykowski-Górecki:\n>> And then scroll up to check for suspiciously extra long lines.\n> \n> What \"suspiciously extra long lines\" means? 2KB or rather 2MB?\n\nGood question. That Julian Andres Klode didn't say. Source:\nhttps://lists.debian.org/debian-security/2016/12/msg00005.html\n\nI've just looked through these lines if anything unusually stands out.\nMost lines are at maximum like ~110 characters long. None of them\nqualified as \"fairly long lines to be able to break this\". I'd expect\n\"fairly long lines\" to easily stand by comparison out when scrolling\nthrough this.\n\nI could ask for clarification if you like. If anyone knows that\nanswer. It may or may not require an actual exploitation proof of\nconcept to know for sure which line length can trigger this.\n"}}
{"actor":{"display_login":"adrelanos"}}