Ubuntu 12.04 LTS USN-1588-1 High: Software Properties GPG Keys Risk

ubuntu

October 1, 2012

Software Properties could be tricked into installing arbitrary PPA GPG keys.

Summary

Software Properties could be tricked into installing arbitrary PPA GPG keys.

Software Description:

- software-properties: manage the repositories that you install software

from

Details:

It was discovered that the apt-add-repository tool incorrectly validated

PPA GPG keys when importing from a keyserver. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could be exploited to

install altered package repository GPG keys.

Topics Covered

security advisory high severity ubuntu package management repository software properties GPG key

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  python-software-properties      0.82.7.3

Ubuntu 11.10:
  python-software-properties      0.81.13.5

Ubuntu 11.04:
  python-software-properties      0.80.9.2

Ubuntu 10.04 LTS:
  python-software-properties      0.75.10.3

In general, a standard system update will make all the necessary changes.