Ubuntu 11.04 USN-1215-1 Moderate: APT Package Installation Risk

ubuntu

September 22, 2011

An attacker could trick APT into installing altered packages.

Summary

An attacker could trick APT into installing altered packages.

Software Description:

- apt: Advanced front-end for dpkg

Details:

It was discovered that the apt-key utility incorrectly verified GPG

keys when downloaded via the net-update option. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could potentially be

used to install altered packages. This update corrects the issue by

disabling the net-update option completely. A future update will re-enable

the option with corrected verification.

Topics Covered

security advisory Ubuntu man-in-the-middle installation issue APT package risk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  apt                             0.8.13.2ubuntu4.2

Ubuntu 10.10:
  apt                             0.8.3ubuntu7.2

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.7

Ubuntu 8.04 LTS:
  apt                             0.7.9ubuntu17.3

In general, a standard system update will make all the necessary changes.