Ubuntu Linux APT CVE-2012-0954 Security Bypass Vulnerability

Bugtraq ID:	54046
Class:	Unknown
CVE:	CVE-2012-0954
Remote:	Yes
Local:	No
Published:	Jun 14 2012 12:00AM
Updated:	Jun 14 2012 12:00AM
Credit:	Georgi Guninski
Vulnerable:	Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 11.04 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 LTS Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Ubuntu APT 0
Not Vulnerable:

Ubuntu Linux APT CVE-2012-0954 Security Bypass Vulnerability

Ubuntu Linux APT package is prone to a security-bypass vulnerability.

Successful exploits could result in a malicious package being installed on the vulnerable computer. This could facilitate a complete system compromise.

Ubuntu Linux APT CVE-2012-0954 Security Bypass Vulnerability

Attackers can exploit this issue through man-in-the-middle attacks.

Ubuntu Linux APT CVE-2012-0954 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu Linux APT CVE-2012-0954 Security Bypass Vulnerability

References:

• net-update verifcation checking is still insecure (aka gpg key shadowing, again) (Ubuntu)
  
• Strange gpg key shadowing (Georgi Guninski)
  
• ubuntu apt-key (part 3) (Georgi Guninski)
  
• Ubuntu Homepage (Ubuntu)
  
• Using second gpg keyring may be misleading? (Georgi Guninski)