USN-1762-1: APT vulnerability

Ubuntu Security Notice USN-1762-1

14th March, 2013

apt vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 12.10
  • Ubuntu 12.04 LTS
  • Ubuntu 11.10

Summary

An attacker could trick APT into installing altered packages.

Software description

  • apt - Advanced front-end for dpkg

Details

Ansgar Burchardt discovered that APT incorrectly handled InRelease files.
If a remote attacker were able to perform a man-in-the-middle attack, this
flaw could potentially be used to install altered packages.

This update corrects the issue by disabling InRelease file support
completely. Please note that this update breaks third-party repositories
that provide only a InRelease file and no separate Release and Release.gpg
files. The default Ubuntu repositories do not use InRelease files.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 12.10:
apt 0.9.7.5ubuntu5.4
Ubuntu 12.04 LTS:
apt 0.8.16~exp12ubuntu10.10
Ubuntu 11.10:
apt 0.8.16~exp5ubuntu13.7

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2013-1051