==========================================================================
Ubuntu Security Notice USN-3156-1
December 13, 2016
apt vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 16.10
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
Summary:
An attacker could trick APT into installing altered packages.
Software Description:
– apt: Advanced front-end for dpkg
Details:
Jann Horn discovered that APT incorrectly handled InRelease files.
If a remote attacker were able to perform a man-in-the-middle attack, this
flaw could potentially be used to install altered packages.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.10:
apt 1.3.2ubuntu0.1
Ubuntu 16.04 LTS:
apt 1.2.15ubuntu0.2
Ubuntu 14.04 LTS:
apt 1.0.1ubuntu2.17
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3156-1
CVE-2016-1252
Package Information:
https://launchpad.net/ubuntu/+source/apt/1.3.2ubuntu0.1
https://launchpad.net/ubuntu/+source/apt/1.2.15ubuntu0.2
https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.17
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJYUEXnAAoJENaSAD2qAscKVt0P/2h3zTHg9fadPOqii2eQoz6A
/SPT35yLEqfNFvC1P0fYQ0Ip1M6OvfjfY6uGAPkCwFY+gETGIXG2wk4u6bzuJOJF
FZeoDI0fZX+pUtqAnKzl6DlI0Saz2k6doOd4mrbqleLqVW2hR0MI2LQ50S2bvhZW
GU4qyXqwo8C2MNphmHFWvI8zEBTzSt/t0zr6UWSFhu2Bn+9F9uwYrwEB/D+R8fyd
pmVdJEqrgZtPRvXagqbaHOqU7YKUa/bullyT3nZ1IX2XiNTjw9FquOOq5k30IZSz
02I3UKN4mlXbdtj5scBqIPGcauzTUWfHeUuiR9n9GmXrc6HAUFZquB/huhHAqW0T
92xLvVq9PsxFFCp1C/Dur1cDuw6dpDBdVl0FMOVR1+l7D0ZemUZsVcs/t8kQGDCx
nifOqpWHpYlY/Gh1MBV98PS6jrL3LEtf4l0CDmyT2H+vO5DHl5+qJf8dN+XRCHFT
vxU0gQwYr7eW7A/QDmGkRqG4LHaoeMx+5VdNX6YjsX5kVR7Chf6C428J8vEIQwQI
3xnKshA+YBnp4uM2IsqUYId6x5JgAZkWBfvFR3JEQyA89UJgZLRl4PQG6N+CqO1y
0fw4R8bqTW5EiuN8k2CXz3SFnbVWSQ6SSVXB+umsZGGuo2IdUyYGguHlohBWWv8m
wh0AyJ9xWyYO1EMw3NcW
=SpIV
—–END PGP SIGNATURE—–
—
