[USN-1666-1] Aptdaemon vulnerability

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/

iQIcBAEBCgAGBQJQzymAAAoJEGVp2FWnRL6T8TkQAKC1VjCFR/23hbfDtFxkzMe0
43IySjrRarI+8cOpmsY7liVtg7yPA4bPKZZVyoTG1p4fViHkR6t5h1hzNl93PRwI
kt/FEWrpk7LgKIhyl5aOyseI+/bzr1yVIOwIcqx3dgMU78KHWxZO8hN+5iaEknIK
j/FPadFcWo+k6S24KhhVgDDvfbmm+/EQAdSxoZpqZI3IDlg/DFeO1tu61YD9h7Wn
hKQOPQDORZAES0TJDORhTaytLp5w47tf/jBFgm/T+nwCUEwY0gGBExkE/jLJ3+FH
KVPYyhPSS19vxFPBP204aXiNnf4eh6QSAQ6AAZfT6ap+8zIWBbEyxc8uG05TEoz5
kiS1ow8bggUlLeBzw/ZIpOzq8MYVa/YEc8+/dz45mtQ4lxILjf0seeYHqTvmECX2
YaHd3qrMKn0hGzLqg3H2+TWn6Xbwiwt5kUpjyecyUF2EZvalBxjsock0kd0OR7X6
0LJL+nJ99fNh4ik/x+5FZvIJZEf9+O55+C0IUjzaY5p2jPjHKDe8PQaiqn33SShB
Sft3tdja7WTvo97NSvlI/dgNlVngbtCCqPwGHc+c5hci9iOmSC8QhMkqWkylmCnx
VE9Kk/8cQviA2NmER0Yr+1NIfinlztzMgc30UIt56UL1EPR10QMBQKIMLreH5zFQ
p5Dof88SDDSTjZut44FA
=k6Jx
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-1666-1
December 17, 2012

aptdaemon vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10

Summary:

Aptdaemon could be tricked into installing arbitrary PPA GPG keys.

Software Description:
- aptdaemon: transaction based package management service

Details:

It was discovered that Aptdaemon incorrectly validated PPA GPG keys when
importing from a keyserver. If a remote attacker were able to perform a
man-in-the-middle attack, this flaw could be exploited to install altered
package repository GPG keys.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
aptdaemon 0.43+bzr805-0ubuntu7

Ubuntu 11.10:
aptdaemon 0.43+bzr697-0ubuntu1.3

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1666-1
CVE-2012-0962

Package Information:
https://launchpad.net/ubuntu/+source/aptdaemon/0.43+bzr805-0ubuntu7
https://launchpad.net/ubuntu/+source/aptdaemon/0.43+bzr697-0ubuntu1.3