USN-1762-1: APT vulnerability
14 March 2013
An attacker could trick APT into installing altered packages.
Releases
Packages
- apt - Advanced front-end for dpkg
Details
Ansgar Burchardt discovered that APT incorrectly handled InRelease files.
If a remote attacker were able to perform a machine-in-the-middle attack, this
flaw could potentially be used to install altered packages.
This update corrects the issue by disabling InRelease file support
completely. Please note that this update breaks third-party repositories
that provide only a InRelease file and no separate Release and Release.gpg
files. The default Ubuntu repositories do not use InRelease files.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 11.10
In general, a standard system update will make all the necessary changes.