Bug#642480: apt-key uses gpg --list-sigs instead of --check-sigs
Subject: apt-key uses gpg --list-sigs instead of --check-sigs
Package: apt
Version: 0.8.10.3+squeeze1
Justification: root security hole
Severity: critical
Tags: security
*** Please type your report below this line ***
Georgi Guninski reported on Full Disclosure a potential bug in apt-key's
use of gpg --list-sigs, when comparing keys to the master keyring in
add_keys_with_verify_against_master_keyring(), revealing a potential
MITM attack for adding keys.
You can find the original emails here:
http://marc.info/?l=full-disclosure&m=131668247124444&w=2
It is a legitimate bug, as far as I can tell, but could use confirmation.
The original message is copied below.
- Chris
From: Georgi Guninski <guninski@guninski.com>
To: full-disclosure@lists.grok.org.uk
Date: Thu, 22 Sep 2011 12:07:08 +0300
Subject: owning ubuntu apt-key net-update (maybe apt-get
update related)
owning ubuntu apt-key net-update (maybe apt-get update related)
in ubuntu 10.04 in /usr/bin/apt-key in
add_keys_with_verify_against_master_keyring()
if $GPG_CMD --keyring $ADD_KEYRING --list-sigs --with-colons $add_key | grep
^sig | cut -d: -f5 | grep -q $master_key; then
$GPG_CMD --quiet --batch --keyring $ADD_KEYRING --export
$add_key | $GPG --import
ADDED=1
to my knowledge --list-sigs doesn't do crypto verification, just looks for well
formedness.
it is trivial to generate a gpg key with key ID == $master_key:
set gpg version to 3, set the lowest 64 bits of the RSA $n$ to the key ID,
generate random high bits until one can trial factor $n$ (numerology is on your
side), this is it.
to reproduce:
attached is ubuntu-archive-keyring.gpg.
put it on http://A/ubuntu-archive-keyring.gpg
make a copy of apt-key and set:
ARCHIVE_KEYRING_URI=http://A/ubuntu-archive-keyring.gpg
^ this emulates MITM.
do |./apt-key-new net-update| and check for new keys with |apt-key list|
this might or might not be related with |apt-get update|.
10x.
--
joro
Reply to: