Subject: apt-key uses gpg --list-sigs instead of --check-sigs Package: apt Version: 0.8.10.3+squeeze1 Justification: root security hole Severity: critical Tags: security
*** Please type your report below this line *** Georgi Guninski reported on Full Disclosure a potential bug in apt-key's use of gpg --list-sigs, when comparing keys to the master keyring in add_keys_with_verify_against_master_keyring(), revealing a potential MITM attack for adding keys. You can find the original emails here: http://marc.info/?l=full-disclosure&m=131668247124444&w=2 It is a legitimate bug, as far as I can tell, but could use confirmation. The original message is copied below. - Chris From: Georgi Guninski <gunin...@guninski.com> To: full-disclos...@lists.grok.org.uk Date: Thu, 22 Sep 2011 12:07:08 +0300 Subject: owning ubuntu apt-key net-update (maybe apt-get update related) owning ubuntu apt-key net-update (maybe apt-get update related) in ubuntu 10.04 in /usr/bin/apt-key in add_keys_with_verify_against_master_keyring() if $GPG_CMD --keyring $ADD_KEYRING --list-sigs --with-colons $add_key | grep ^sig | cut -d: -f5 | grep -q $master_key; then $GPG_CMD --quiet --batch --keyring $ADD_KEYRING --export $add_key | $GPG --import ADDED=1 to my knowledge --list-sigs doesn't do crypto verification, just looks for well formedness. it is trivial to generate a gpg key with key ID == $master_key: set gpg version to 3, set the lowest 64 bits of the RSA $n$ to the key ID, generate random high bits until one can trial factor $n$ (numerology is on your side), this is it. to reproduce: attached is ubuntu-archive-keyring.gpg. put it on http://A/ubuntu-archive-keyring.gpg make a copy of apt-key and set: ARCHIVE_KEYRING_URI=http://A/ubuntu-archive-keyring.gpg ^ this emulates MITM. do |./apt-key-new net-update| and check for new keys with |apt-key list| this might or might not be related with |apt-get update|. 10x. -- joro -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
