Ubuntu 14.04 LTS USN-2246-1 Critical: APT Altered Packages Issue

ubuntu

June 17, 2014

An attacker could trick APT into installing altered source packages.

Summary

An attacker could trick APT into installing altered source packages.

Software Description:

- apt: Advanced front-end for dpkg

Details:

Jakub Wilk discovered that APT did not correctly validate signatures when

downloading source packages. If a remote attacker were able to perform a

man-in-the-middle attack, this flaw could potentially be used to install

altered source packages.

Topics Covered

security advisory critical Ubuntu man-in-the-middle package integrity APT issue install packages

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  apt                             1.0.1ubuntu2.1

Ubuntu 13.10:
  apt                             0.9.9.1~ubuntu3.2

Ubuntu 12.04 LTS:
  apt                             0.8.16~exp12ubuntu10.17

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.15

In general, a standard system update will make all the necessary changes.