USN-1477-1: APT vulnerability

Releases

• Ubuntu 12.04
• Ubuntu 11.10
• Ubuntu 11.04
• Ubuntu 10.04
• Ubuntu 8.04

Packages

• apt - Advanced front-end for dpkg

Details

Georgi Guninski discovered that APT did not properly validate imported
keyrings via apt-key net-update. USN-1475-1 added additional verification
for imported keyrings, but it was insufficient. If a remote attacker were
able to perform a machine-in-the-middle attack, this flaw could potentially be
used to install altered packages. This update corrects the issue by
disabling the net-update option completely. A future update will re-enable
the option with corrected verification.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.04

• apt - 0.7.9ubuntu17.6

Ubuntu 12.04

• apt - 0.8.16~exp12ubuntu10.2

Ubuntu 11.10

• apt - 0.8.16~exp5ubuntu13.5

Ubuntu 11.04

• apt - 0.8.13.2ubuntu4.6

Ubuntu 10.04

• apt - 0.7.25.3ubuntu9.13

In general, a standard system update will make all the necessary changes.

References

• CVE-2012-0954