PT-2014-5103 · Debian+1 · Dpkg+1

Javier Serrano Polo · Publicado 2014-05-01 · Atualizado 2014-06-05 · CVE-2014-3127

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:H/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions dpkg version 1.15.9

Description The issue arises from the introduction of support for C-style encoded filenames in dpkg 1.15.9 on Debian squeeze, without considering that the squeeze patch program does not have this feature. This leads to an interaction error, allowing remote attackers to perform directory traversal attacks and modify files outside the intended directories by using a crafted source package.

Recommendations For dpkg version 1.15.9, consider disabling the C-style encoded filenames feature as a temporary workaround until a patch is available. Restrict access to the package installation process to minimize the risk of exploitation. Avoid using crafted source packages until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2014-1627

CVE-2014-3127

DSA-2915-2

USN-2183-2

Produtos afetados

Alt Linux

Dpkg

Referências · 22

• https://errata.altlinux.org/ALT-PU-2014-1627 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3127 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3127 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-0471 · Aviso do Fabricante
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306 · Nota
• https://ubuntu.com/security/CVE-2014-3127 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2183-2 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3127 · Aviso do Fabricante
• http://seclists.org/oss-sec/2014/q2/227 · Nota
• https://lists.debian.org/debian-security-announce/2014/msg00099.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0471 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-3127 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2014-3127 · Nota
• http://metadata.ftp-master.debian.org/changelogs//main/d/dpkg/dpkg_1.15.10_changelog · Nota
• https://bdu.fstec.ru/vul/2015-02154 · Nota de Segurança