Still present in 12.04 LTS, Precise running apt 0.8.16 In my case the corrupted package list files in /var/lib/apt/lists are caused by the router redirecting to an internal help page when it realises that its internet connection is down. So, when a fetch is attempted from, say gb.archive.ubuntu.com/ubuntu/dists/precise- updates/universe/binary-i386/Packages when checking for updates what comes back is the html source from the router's help page (example attached -- line 52 contains the requested url).
It would appear that no sanity check is done on the returned data leaving subsequent parse attempts to choke. The corrupted files remain and may propagate (???) causing other update failures. On a security note, it occurs to me that an attacker in control of the router could return crafted files in place of apt's package lists to introduce malware as part of the normal automated update process. I trust checks are in place to prevent this??? ** Attachment added: "Example corrupted package list file from /var/lib/apt/lists" https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1001209/+attachment/3341765/+files/gb.archive.ubuntu.com_ubuntu_dists_precise-updates_universe_binary-i386_Packages.IndexDiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1001209 Title: When connected to a network with a catch-all HTTP filter, apt-get update corrupts the package lists To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1001209/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
