PT-2014-5103 · Debian+1 · Dpkg+1

Javier Serrano Polo · Published 2014-05-01 · Updated 2014-06-05 · CVE-2014-3127

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions dpkg version 1.15.9

Description The issue arises from the introduction of support for C-style encoded filenames in dpkg 1.15.9 on Debian squeeze, without considering that the squeeze patch program does not have this feature. This leads to an interaction error, allowing remote attackers to perform directory traversal attacks and modify files outside the intended directories by using a crafted source package.

Recommendations For dpkg version 1.15.9, consider disabling the C-style encoded filenames feature as a temporary workaround until a patch is available. Restrict access to the package installation process to minimize the risk of exploitation. Avoid using crafted source packages until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2014-1627

CVE-2014-3127

DSA-2915-2

USN-2183-2

Affected Products

Alt Linux

Dpkg

References · 22

• https://errata.altlinux.org/ALT-PU-2014-1627 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3127 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3127 · Security Note
• https://ubuntu.com/security/CVE-2014-0471 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3127 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2183-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3127 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3127 · Security Note
• https://bdu.fstec.ru/vul/2015-02154 · Security Note
• https://ubuntu.com/security/notices/USN-2183-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3127 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3127 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3227 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-3127 · Security Note