apt-get upgrading security issue CVE-2016-1252

Good day,

@entr0py: Yes, that does it. Now the question is whether this is safe to do, as while the system is telling me that is already installed for apt, meaning the issue should be resolved, however, other packages relying on apt aren’t upgraded at that point.

Ok. That still leaves libapt. Is it reasonable to assume that it has no impact on this issue and thus running apt with it still under is safe?

Have a nice day,


Since I am not sure if just the upgraded apt package suffices: No (not safe).

One would have to manually download, verify and install all aptish packages with version from to

If you want to have a look when you upgraded which package:

cat /var/log/apt/history.log

Updated https://www.whonix.org/wiki/CVE-2016-1252 to include all aptish packages. Should be no more need for apt-get -f install now.

Good day,

Now it works without issue for all packages related to apt.

Have a nice day,


1 Like

Since users who download Whonix images now are vulnerable and easily fall for regular upgardes, a warning for all supported Whonix platforms on their respective download pages has been added. Implemented just now in a form of a wiki template.


The plan is that once Whonix images with fixed apt are released as stable, that template will be emptied (should then have the same effect as not being added). Should a similar situation arise, that template can be refilled.


Good day,

I feel like this has already been discussed during the transitional phase from Whonix 12 to 13, though in the wake of this security issue, it might be a good idea to bring it up again. It would perhaps be a good idea to have an aditional field in Whonixcheck which informs users of imminent issues or events, like upgrading to a new version or a bigger security flaw which requires manual changes, like this, since a lot of users likely don’t read the blog or subscribe to a newsletter. Those things of course are still important though for emergencies like this, a seperate way of communcating might be a good idea.

Have a nice day,


It would perhaps be a good idea to have an aditional field in Whonixcheck which informs users of imminent issues or events,

There is an insufficient one. Called Whonix News as part of whonixcheck. (old screenshot) Insufficient, because it gets hardly noticed by anyone ever. [At least the news files gpg verification stuff is done and hopefully solid, see source code.]

This is related to Whonix Upgrade Notification. The mockup by @entr0py in thread Whonix Upgrade Notification looks good.

[ ] Do not show again [ OK ]

Very true. Very much needed.


Similarly a ticket for Emergency News Notification is does not yet exist. Ideally also a generic package that can enter packages.debian.org, where Debian and its derivatives such as Qubes and Whonix can drop .d style configuration snippets.

A generic package is better. Then Debian would have informed us about this CVE-2016-1252 earlier.

Ideally the Emergency News Notification tool would also have a Permanent Takedown Attack Defender feature. The initial version wouldn’t require that, but I would be good to plan ahead so it can be added in a later iteration.

Since this is a rather involved project, I suggest to start with a great description of the problems we are seeing, as well as with the solution we are proposing. And then post this on the debian-devel mailing list in the hope that people agree and $someone will implement it. [And even if there is no $someone, there will be hopefully a ton of feedback on how to get this right.] Anyone wanting to take the lead on that? :slight_smile:


For an alternative way to check for being safe from CVE-2016-1252, critically review the following comment by me:

emergency news proposal (features, mockup, test cases, security, communications, etc.) can be added here:

i couldnt add the result in the forum because it exceeds 40000 character

but there non-free package updating ? hmm thats weird

ok found the non-free packages , it came from debian.list which is found in ;-



i couldnt add the result in the forum because it exceeds 400000 character

No need.

but there non-free package updating ?


This bug is getting more and more obscure. debootstraping is no longer safe as Marek pointed out.

Asked on the debian-security mailing list about that. (My message has not yet appeared on debian-security mailing list archive but you can read my message here. Will keep you posted on replies.)

Translated into less obscure terms: no downloadable upgraded Qubes or Non-Qubes-Whonix templates can be created before a solution to this issue was found.

1 Like

Very intersting response by an apt developer that I am going to study closer:

Please review this alternative sanity check:

1 Like

Good day,

Just checked it. Works as well.

Have a nice day,


1 Like

Thanks. Old workaround deprecated.


1 Like
  1. Is there anyway to verify non compromise yet for users who had already upgraded to version other than looking for “suspiciously extra long lines”? If not, how sure can one be of non compromise?

  2. If running Qubes OS, could other VMs possibly be compromised?

  3. What is best recommendation for user already upgraded to version

1 Like

There is none. And there will very much likely none in the foreseeable future. This is due to the the nature of malware. Detailed explanation:

Practically, you cannot.

If the attacker used this exploit and then also was smart enough to have another exploit against xen and used that, then yes, also other VMs could possibly be comprised

Nothing. That is being discussed here:

That’s what I was afraid of.

Would you consider looking for “suspiciously extra long lines” and finding none, a reasonable confirmation of not having been compromised?
Following the directions, I didn’t see anything obviously suspicious.

Don’t believe I’m a target, just privacy conscious.
Going to put you on the spot. Sorry…
If it were you, what would you do in this situation?

No, because that is the first thing sophisticated malware would cover up after getting active on the system. And any attacker who exploited this vulnerability would certainly fit the definition of sophisticated.

[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Contributors] [Investors] [Priority Support] [Professional Support]