USN-1762-1: APT vulnerability

14 March 2013

apt vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 12.10
  • Ubuntu 12.04 LTS
  • Ubuntu 11.10

Summary

An attacker could trick APT into installing altered packages.

Software Description

  • apt - Advanced front-end for dpkg

Details

Ansgar Burchardt discovered that APT incorrectly handled InRelease files. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to install altered packages.

This update corrects the issue by disabling InRelease file support completely. Please note that this update breaks third-party repositories that provide only a InRelease file and no separate Release and Release.gpg files. The default Ubuntu repositories do not use InRelease files.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.10
apt - 0.9.7.5ubuntu5.4
Ubuntu 12.04 LTS
apt - 0.8.16~exp12ubuntu10.10
Ubuntu 11.10
apt - 0.8.16~exp5ubuntu13.7

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References