Improper verification of updated key via apt-key net-update

[Jamie Strandboge]

As reported on full-disclosure:
http://seclists.org/fulldisclosure/2011/Sep/221

CVE request here:
http://www.openwall.com/lists/oss-security/2011/09/22/5

[Jamie Strandboge (jdstrand)]

Marc is working on a temporary fix until the real fix is prepared.

[Kees Cook (kees)]

If anyone can't wait for updates, removing the keyring URI from /usr/bin/apt-key should disable the fetch:

#ARCHIVE_KEYRING_URI=http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg
ARCHIVE_KEYRING_URI=

[Jamie Strandboge (jdstrand)]

Packages are building now and updates will be made available shortly. The temporary fix disabling net-update for all releases can be seen in https://launchpad.net/ubuntu/+source/apt/0.8.16~exp5ubuntu11.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 0.8.13.2ubuntu4.2

---------------
apt (0.8.13.2ubuntu4.2) natty-security; urgency=low

  * SECURITY UPDATE: Disable apt-key net-update for now, as validation
    code is insecure. (LP: #856489)
    - cmdline/apt-key: exit immediately out of net_update().
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Thu, 22 Sep 2011 11:03:15 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 0.8.3ubuntu7.2

---------------
apt (0.8.3ubuntu7.2) maverick-security; urgency=low

  * SECURITY UPDATE: Disable apt-key net-update for now, as validation
    code is insecure. (LP: #856489)
    - cmdline/apt-key: exit immediately out of net_update().
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Thu, 22 Sep 2011 11:23:05 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 0.7.25.3ubuntu9.7

---------------
apt (0.7.25.3ubuntu9.7) lucid-security; urgency=low

  * SECURITY UPDATE: Disable apt-key net-update for now, as validation
    code is insecure. (LP: #856489)
    - cmdline/apt-key: exit immediately out of net_update().
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Thu, 22 Sep 2011 11:24:50 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 0.7.9ubuntu17.3

---------------
apt (0.7.9ubuntu17.3) hardy-security; urgency=low

  * SECURITY UPDATE: Disable apt-key net-update for now, as validation
    code is insecure. (LP: #856489)
    - cmdline/apt-key: exit immediately out of net_update().
    - CVE number pending
 -- Marc Deslauriers <email address hidden> Thu, 22 Sep 2011 11:26:16 -0400