PT-2009-5293 · Debian · Devscripts

Raphael Geissert · Published 2009-09-04 · Updated 2009-09-08 · CVE-2009-2946

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: devscripts versions prior to Rev 1984

Description: The issue allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages. This is due to an eval injection vulnerability in the scripts/uscan.pl script.

Recommendations: For devscripts versions prior to Rev 1984, update to a version that includes the fix for this issue, specifically Rev 1984 or later.

Fix

Related Identifiers

CVE-2009-2946

DSA-1878-1

DSA-1878-2

Affected Products

Devscripts

References · 8

• http://debian.org/security/2009/dsa-1878 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2946 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-2946 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2946 · Security Note
• http://svn.debian.org/wsvn/devscripts/trunk/scripts/uscan.pl?op=log&rev=0&sc=1&isdir=0 · Note
• http://svn.debian.org/wsvn/devscripts/trunk/scripts/uscan.pl?op=diff&rev=1984&sc=1 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515209 · Note