USN-1762-1: APT vulnerability
Ubuntu Security Notice USN-1762-1
14th March, 2013
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
An attacker could trick APT into installing altered packages.
- apt - Advanced front-end for dpkg
Ansgar Burchardt discovered that APT incorrectly handled InRelease files.
If a remote attacker were able to perform a man-in-the-middle attack, this
flaw could potentially be used to install altered packages.
This update corrects the issue by disabling InRelease file support
completely. Please note that this update breaks third-party repositories
that provide only a InRelease file and no separate Release and Release.gpg
files. The default Ubuntu repositories do not use InRelease files.
The problem can be corrected by updating your system to the following package version:
- Ubuntu 12.10:
- apt 0.9.7.5ubuntu5.4
- Ubuntu 12.04 LTS:
- apt 0.8.16~exp12ubuntu10.10
- Ubuntu 11.10:
- apt 0.8.16~exp5ubuntu13.7
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.