PT-2014-5151 · Debian+1 · Dpkg+1

Raphael Geissert · Publicado 2014-05-13 · Atualizado 2014-06-24 · CVE-2014-3227

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions dpkg versions 1.15.9, 1.16.x through 1.16.13, and 1.17.x through 1.17.8

Description The issue arises from dpkg's expectation that the patch program supports "C-style encoded filenames", which can lead to an interaction error in environments where the patch program does not comply with this requirement. This error can be exploited by remote attackers to conduct directory traversal attacks, allowing them to modify files outside the intended directories by using a crafted source package.

Recommendations For dpkg version 1.15.9, update to a version that does not rely on the "C-style encoded filenames" feature for security. For dpkg versions 1.16.x through 1.16.13, update to version 1.16.14 or later. For dpkg versions 1.17.x through 1.17.8, update to version 1.17.9 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2014-1627

CVE-2014-3227

DSA-2915-2

Produtos afetados

Alt Linux

Dpkg

Referências · 13

• https://errata.altlinux.org/ALT-PU-2014-1627 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/05/29/16 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3127 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3227 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-02154 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2014-3227 · Nota
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3227 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2014-3227 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/04/29/4 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3227 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0471 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-3227 · Aviso do Fabricante