Ubuntu: 1352-1 Moderate: GPG Key Manipulation Risk in Software Properties

ubuntu

January 31, 2012

Software Properties could be tricked into installing arbitrary PPA GPG keys.

Summary

Software Properties could be tricked into installing arbitrary PPA GPG

keys.

Software Description:

- software-properties: manage the repositories that you install software from

Details:

David Black discovered that Software Properties incorrectly validated

server certificates when performing secure connections to download PPA GPG

key fingerprints. If a remote attacker were able to perform a

man-in-the-middle attack, this flaw could be exploited to install altered

package repository GPG keys.

Topics Covered

security advisory moderate threat ubuntu gpg key manipulation package repository

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  python-software-properties      0.81.13.3

Ubuntu 11.04:
  python-software-properties      0.80.9.1

Ubuntu 10.10:
  python-software-properties      0.76.7.1

Ubuntu 10.04 LTS:
  python-software-properties      0.75.10.2

In general, a standard system update will make all the necessary changes.