CVE:CVE-2012-3587
CNNVD:CNNVD-201206-356
APT 0.7.25之前的0.7.x版本和0.8.16之前的0.8.x版本中存在漏洞，当使用apt-key net-update导入密钥环时，依赖GnuPG自变量顺序并且不检测GPG子键。远程攻击者可利用该漏洞通过中间人（MITM）攻击安装Trojan木马数据包。
solution:Upgrade debian advanced_package_tool to a higher version than 0.7.0,0.7.1,0.7.2,0.7.2-0.1,0.7.10,0.7.11,0.7.12,0.7.13,0.7.14,0.7.15,0.7.15:exp1,0.7.15:exp2,0.7.15:exp3,0.7.16,0.7.17,0.7.17:exp1,0.7.17:exp2,0.7.17:exp3,0.7.17:exp4,0.7.18,0.7.19,0.7.20,0.7.20.1,0.7.20.2,0.7.21,0.7.22,0.7.22.1,0.7.22.2,0.7.23,0.7.23.1,0.7.24,0.8.0,0.8.0:pre1,0.8.0:pre2,0.8.1,0.8.10,0.8.10.1,0.8.10.2,0.8.10.3,0.8.11,0.8.11.1,0.8.11.2,0.8.11.3,0.8.11.4,0.8.11.5,0.8.12,0.8.13,0.8.13.1,0.8.13.2,0.8.14,0.8.14.1,0.8.15,0.8.15:exp1,0.8.15:exp2,0.8.15:exp3,0.8.15.1,0.8.15.6,0.8.15.7,0.8.15.8,0.8.15.9,0.8.15.10,and avoid the version 0.7.0,0.7.1,0.7.2,0.7.2-0.1,0.7.10,0.7.11,0.7.12,0.7.13,0.7.14,0.7.15,0.7.15:exp1,0.7.15:exp2,0.7.15:exp3,0.7.16,0.7.17,0.7.17:exp1,0.7.17:exp2,0.7.17:exp3,0.7.17:exp4,0.7.18,0.7.19,0.7.20,0.7.20.1,0.7.20.2,0.7.21,0.7.22,0.7.22.1,0.7.22.2,0.7.23,0.7.23.1,0.7.24,0.8.0,0.8.0:pre1,0.8.0:pre2,0.8.1,0.8.10,0.8.10.1,0.8.10.2,0.8.10.3,0.8.11,0.8.11.1,0.8.11.2,0.8.11.3,0.8.11.4,0.8.11.5,0.8.12,0.8.13,0.8.13.1,0.8.13.2,0.8.14,0.8.14.1,0.8.15,0.8.15:exp1,0.8.15:exp2,0.8.15:exp3,0.8.15.1,0.8.15.6,0.8.15.7,0.8.15.8,0.8.15.9,0.8.15.10