I am trying to understand the do-release-upgrade process i.e. the way that Ubuntu prompts me to upgrade to the next spring or autumn Ubuntu release.

After reading the sources for ubuntu-release-upgrader I found the /etc/update-manager/meta-release file on my system. This file appears use an HTTP URL to point to http://changelogs.ubuntu.com/meta-release where the various Ubuntu releases from Warty 04.10 to Raring 13.04 are listed. This file lists the releases, their support status, the date of release and has a link to the Release file.

Now the Release file has a corresponding GPG signature and the sha1sum of the Packages file which, in turn, has the sha1sum of the individual DEB binaries that get installed. The recent releases also have an upgrade script and a corresponding GPG signature for these too. All sounds good.

My question is about the meta-release file itself. It is not served over HTTPS and I cannot find a GPG signature for it. If somebody replaces this file could they somehow cause my machine to upgrade...

• ...to a signed release that hasn't yet gone through security testing?
• ...to an old release that is not supported and has unfixed security vulnerabilities?
• Very good question and well-written. If this security issue can be confirmed and the developers are notified I think this should be (undisclosed) until fixed. My first thought is that this indeed sounds vulnerable for a man-in-the-middle attack. A user still has to confirm the upgrade, though. – gertvdijk Jul 6 '13 at 16:11
• I have gathered some more information in the meantime and once I found time to support it with facts/experiments I'll post it as an answer. Do note that the UpgradeToolSignature is still there, so it will only upgrade using a tool signed by Canonical (but yeah, that does not mitigate the concerns you have). – gertvdijk Jul 9 '13 at 8:42
• I tried forcing a downgrade to an old version but the upgrade script said it didn't know how to upgrade from raring to hardy. Apt doesn't downgrade without an override. It looks like the worst you can do is prompt your victim to upgrade to a newer release than they want e.g. development or non-lts. – jwal Jul 10 '13 at 17:30
• I was thinking about another approach. Hint: no input sanitizing. I'll find some time over the weekend probably. :) – gertvdijk Jul 10 '13 at 18:20
• I would be more concerned with one of the Ubuntu repo's being compromised and having the packages replaced with trojanized ones that are signed with the same one defined in the meta file. – Justin Andrusk Sep 29 '13 at 3:08

do-release-upgrade requires admin rights, and if you are on a LTS release, will stay on that and not automatically bump you up a version. If you use non-official sources it brings up a bunch of warning messages.

However, GUI variants on this are, to the end user, no different to UAC on Windows, where anyone not technically minded enough will just click the button or type in the password, ignore warnings and go off to make a cup of tea. So in practice, it's no more or less secure than Windows Update.

In short - I wouldn't trust the upgrade to be secure. In fact, if you are on a LTS and using Ubuntu for mission critical stuff, I'd avoid upgrading a major version until your release is no longer supported - upgrading does break stuff in subtle ways which takes time for you to fix.

• My question is actually about a hacker out on the network - like a man in the middle - rather than on the local machine running the upgrade. I already know that you need to be root to run the upgrade on the local machine. – jwal Jun 17 '14 at 17:59
• Only Admin can cause permanent changes to the files in pc. Guest users can't change these(or any other) files.So no one else than the admin himself/herself can cause update-manager to look for some potentially harmful link.

• now, the Admin will not damage his own pc(unless he is out of his mind).And one should never let any third-person to access Admin Rights.So there is practically no risk.

• Maybe malicious apps could,but if you use trusted repos,this risk does not prevail.
• As @gertvdijk said,user still has to confirm the upgrades
• And finally you can always restore the original link.

So in short "somebody" can't change this file.Only the Admin can make changes to files.

this process could surely be more secure.maybe software updater could encrypt these files and also use a gpg key

Finally Ubuntu weekly newsletter keeps you updated with recent updates/upgrades.you can confirm from it so that you can ensure your pc's security to the best.