Summary
Ubuntu Update for Linux kernel vulnerabilities USN-1477-1
Solution
Please Install the Updated Packages.
Insight
Georgi Guninski discovered that APT did not properly validate imported keyrings via apt-key net-update. USN-1475-1 added additional verification for imported keyrings, but it was insufficient. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to install altered packages. This update corrects the issue by disabling the net-update option completely. A future update will re-enable the option with corrected verification.
Affected
apt on Ubuntu 12.04 LTS ,
Ubuntu 11.10 ,
Ubuntu 11.04 ,
Ubuntu 10.04 LTS ,
Ubuntu 8.04 LTS
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2012-0954 -
CVSS Base Score: 2.6
AV:N/AC:H/Au:N/C:N/I:P/A:N
Related Vulnerabilities