Ubuntu 11.04 LTS: USN-1283-1 Critical: APT Info Exposure

ubuntu

November 28, 2011

APT could be made to expose sensitive information over the network.

Summary

APT could be made to expose sensitive information over the network.

Software Description:

- apt: Advanced front-end for dpkg

Details:

It was discovered that APT incorrectly handled the Verify-Host

configuration option. If a remote attacker were able to perform a

man-in-the-middle attack, this flaw could potentially be used to steal

repository credentials. This issue only affected Ubuntu 10.04 LTS and

10.10. (CVE-2011-3634)

USN-1215-1 fixed a vulnerability in APT by disabling the apt-key net-update

option. This update re-enables the option with corrected verification.

Original advisory details:

It was discovered that the apt-key utility incorrectly verified GPG

keys when downloaded via the net-update option. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could potentially be

used to install altered packages.

Topics Covered

security advisory critical Ubuntu information exposure APT

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  apt                             0.8.13.2ubuntu4.3

Ubuntu 10.10:
  apt                             0.8.3ubuntu7.3

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.9

Ubuntu 8.04 LTS:
  apt                             0.7.9ubuntu17.4

In general, a standard system update will make all the necessary changes.