==========================================================================
Ubuntu Security Notice USN-2353-1
September 23, 2014

apt vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS
– Ubuntu 10.04 LTS

Summary:

APT could be made to crash or run programs if it received specially crafted
network traffic.

Software Description:
– apt: Advanced front-end for dpkg

Details:

It was discovered that APT incorrectly handled certain http URLs. If a
remote attacker were able to perform a man-in-the-middle attack, this flaw
could be exploited to cause APT to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2014-6273)

In addition, this update fixes regressions introduced by the USN-2348-1
security update: APT incorrectly handled file:/// sources on a different
partition, incorrectly handled Dir::state::lists set to a relative path,
and incorrectly handled cdrom: sources.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
apt 1.0.1ubuntu2.4.1

Ubuntu 12.04 LTS:
apt 0.8.16~exp12ubuntu10.20.1

Ubuntu 10.04 LTS:
apt 0.7.25.3ubuntu9.17.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2353-1
CVE-2014-6273

Package Information:
https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.4.1
https://launchpad.net/ubuntu/+source/apt/0.8.16~exp12ubuntu10.20.1
https://launchpad.net/ubuntu/+source/apt/0.7.25.3ubuntu9.17.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJUIaIZAAoJEGVp2FWnRL6T7EcP/iLC95LQVfbpaHz6ErzfGT+P
8pMsQc/2rmgORlS/VaFKbpjywIxDQt4va8nuRAW+nq7Xb+NzJgUwzSqiUkmN/fGW
FNDBsw+Yn3B/7i354uJbO/Df6oeBKfBkc+mIOQZL1KEaU4l/rZDm0X1NqolI+Oul
ihM3redNppqjRhmbcp9VUiVxvsskvyc921zAUd9l0hdsWe7zbDS3gHCKksE+zRrE
pnWgelkh7fNLzf2/AAMwixwRFHR+sFVzxOi0jCdN28MEYerJti+4nz3To62PngUW
eLtZIqPtlcmInfdy0tlfZu+FKUMePnNv0GhnaS94dqv4Kj9O0W/qwpLcZnhMSsHW
A8IJNFt1Wj5z6AtHwlX2CxVTRjFtXy2uvO5gPiF9B1LlgYYplTLpbK7aOd1IAIow
2zoySzVNbV4fJ93NGPrUCvSSnmg+McrvyTYAroWH3gtThDWiKpwJKZXccEGERbbC
Nnsg74zfFc96uppaHexNmKPsoZPH8FYdBblJuPcn1Zu0yIL6PWfojdY0vMReMYjd
53zg25IHqy8FUpk3UAIBIXNV51FktjlwOtVPVeGyPAtzH+mfFStEevl3E3RV0lGZ
DbaPQwiWB5ZA0E5aUdGpMwXi72dPoDEQwILmry9uTr5hJXOIJfM+kGEmVLR3z3XK
Bw+WzsFkK1AHwZjtyrZ3
=0Szv
—–END PGP SIGNATURE—–
—