[Bug 1518785] [NEW] Root-owned files being overwritten with HTML by unknown program.

Wed Nov 25 17:58:27 UTC 2015

You have been subscribed to a public bug:

On my wife's laptop running  Trusty, patched to approximately a week ago, all of the
/var/lib/apt/lists/*i18n_Translation_en* files were trashed by being overwritten by
an HTML file from OMNI Hotels (first few lines pasted below).    We had looked at the 
hotel network signup page using Firefox but decided against paying for the hotel net,

The ownership,group for the overwritten files  was still root,root and
writeable only by owner.

The overwriting of these files his broke updates.  Moving these HTML files into
a "jail" directory and running "apt-get update; apt-get upgrade" seems to have
gotten updating working again.

I have not found any other overwritten files, or other damage,  yet.

This seems to have been  benign but annoying, but it's unsettling to see root files overwritten
by a hotel network login like this.

First few lines of the HTML file.  the latter part has "terms and
conditions, etc.":

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML>
<HEAD>
  <title>Omni Hotels</title>
   <meta http-equiv="X-UA-Compatible" content="IE=7,IE=9" >
   <link rel="stylesheet" type="text/css" href="https://nomadix.omnihotels.com/css/nomadix/bootstrap_MPY_v1.css" />
   <link rel="stylesheet" type="text/css" href="https://nomadix.omnihotels.com/css/nomadix/common.css" />
   <link rel="stylesheet" type="text/css" href="https://nomadix.omnihotels.com/css/nomadix/custom.css" />

   <script language="javascript" src="https://nomadix.omnihotels.com/js/nomadix/nomadix.js"></script>
   <script language="javascript" src="https://nomadix.omnihotels.com/js/jquery-1.11.1.min.js"></script>
   <script language="javascript" src="https://nomadix.omnihotels.com/js/jquery-ui-1.8.16.custom.min.js"></script>
   <script language="javascript" src="https://nomadix.omnihotels.com/js/bootstrap-3.2.min.js"></script>

(I've saved the full content of these files for possible later analysis.)

** Affects: apt (Ubuntu)
     Importance: Undecided
         Status: New

-- 
Root-owned files being overwritten with HTML by unknown program.
https://bugs.launchpad.net/bugs/1518785
You received this bug notification because you are a member of Ubuntu Foundations Bugs, which is subscribed to apt in Ubuntu.