Do not parse Status fields from remote sources

This could allow an attacker to mark a package as installed in a
remote package index, as long as the package was not listed in
the dpkg status file.

This way, an attacker could force the installation of a package
during a dist-upgrade, by providing two packages in an index,
an older marked as installed, and a newer - apt would "upgrade"
to the newer version.

1 files changed, 11 insertions, 0 deletions

diff --git a/apt-pkg/deb/debindexfile.cc b/apt-pkg/deb/debindexfile.cc
index c43ee7b91..32ccd7529 100644
--- a/apt-pkg/deb/debindexfile.cc
+++ b/apt-pkg/deb/debindexfile.cc
@@ -145,6 +145,17 @@ uint8_t debStatusIndex::GetIndexFlags() const
 {
    return pkgCache::Flag::NotSource;
 }
+
+pkgCacheListParser * debStatusIndex::CreateListParser(FileFd &Pkg)
+{
+   if (Pkg.IsOpen() == false)
+      return NULL;
+   _error->PushToStack();
+   pkgCacheListParser * const Parser = new debStatusListParser(&Pkg);
+   bool const newError = _error->PendingError();
+   _error->MergeWithStack();
+   return newError ? NULL : Parser;
+}
 									/*}}}*/
 // DebPkgFile Index - a single .deb file as an index			/*{{{*/
 debDebPkgFileIndex::debDebPkgFileIndex(std::string const &DebFile)