USN-2246-1: APT vulnerability

Releases

• Ubuntu 14.04 ESM
• Ubuntu 13.10
• Ubuntu 12.04
• Ubuntu 10.04

Packages

• apt - Advanced front-end for dpkg

Details

Jakub Wilk discovered that APT did not correctly validate signatures when
downloading source packages. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could potentially be used to install
altered source packages.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04

• apt - 1.0.1ubuntu2.1

Ubuntu 13.10

• apt - 0.9.9.1~ubuntu3.2

Ubuntu 12.04

• apt - 0.8.16~exp12ubuntu10.17

Ubuntu 10.04

• apt - 0.7.25.3ubuntu9.15

In general, a standard system update will make all the necessary changes.

References

• CVE-2014-0478