An attacker could trick APT into installing altered packages.
Ansgar Burchardt discovered that APT incorrectly handled InRelease files. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to install altered packages.
14 March 2013
A security issue affects these releases of Ubuntu and its derivatives:
An attacker could trick APT into installing altered packages.
Ansgar Burchardt discovered that APT incorrectly handled InRelease files. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to install altered packages.
This update corrects the issue by disabling InRelease file support completely. Please note that this update breaks third-party repositories that provide only a InRelease file and no separate Release and Release.gpg files. The default Ubuntu repositories do not use InRelease files.
The problem can be corrected by updating your system to the following package versions:
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
Vulmon