Ubuntu 12.04 LTS USN-1477-1 Moderate: Man-In-The-Middle APT Threat

ubuntu

June 15, 2012

An attacker could trick APT into installing altered packages.

Summary

An attacker could trick APT into installing altered packages.

Software Description:

- apt: Advanced front-end for dpkg

Details:

Georgi Guninski discovered that APT did not properly validate imported

keyrings via apt-key net-update. USN-1475-1 added additional verification

for imported keyrings, but it was insufficient. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could potentially be

used to install altered packages. This update corrects the issue by

disabling the net-update option completely. A future update will re-enable

the option with corrected verification.

Topics Covered

security advisory moderate Ubuntu package management apt

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  apt                             0.8.16~exp12ubuntu10.2

Ubuntu 11.10:
  apt                             0.8.16~exp5ubuntu13.5

Ubuntu 11.04:
  apt                             0.8.13.2ubuntu4.6

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.13

Ubuntu 8.04 LTS:
  apt                             0.7.9ubuntu17.6

In general, a standard system update will make all the necessary changes.