Ubuntu 12.04 LTS USN-1475-1 Critical: APT Keyring Validation

ubuntu

June 15, 2012

APT now more thoroughly verifies imported keyrings.

Summary

APT now more thoroughly verifies imported keyrings.

Software Description:

- apt: Advanced front-end for dpkg

Details:

Georgi Guninski discovered that APT relied on GnuPG argument order and did

not check GPG subkeys when validating imported keyrings via apt-key

net-update. While it appears that a man-in-the-middle attacker cannot

exploit this, as a hardening measure this update adjusts apt-key to

validate all subkeys when checking for key collisions.

Topics Covered

security advisory critical Ubuntu APT keyring

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  apt                             0.8.16~exp12ubuntu10.1

Ubuntu 11.10:
  apt                             0.8.16~exp5ubuntu13.4

Ubuntu 11.04:
  apt                             0.8.13.2ubuntu4.5

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.12

Ubuntu 8.04 LTS:
  apt                             0.7.9ubuntu17.5

In general, a standard system update will make all the necessary changes.