PT-2015-3303 · Gnu+3 · Gnu Patch+3

Vasyl Kaigorodov · Published 2015-01-21 · Updated 2017-08-30 · CVE-2015-1395

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions GNU Patch versions prior to 2.7.3

Description The issue is related to a directory traversal vulnerability in GNU Patch, which affects versions that support Git-style patching. This vulnerability can be exploited by a remote attacker to modify arbitrary files with the permissions of the target user. The exploitation is possible via a .. (dot dot) in a diff file name, allowing the attacker to traverse the directory and access files outside the intended directory.

Recommendations For GNU Patch versions prior to 2.7.3, update to version 2.7.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of Git-style patching in GNU Patch until a patch is available. Avoid using diff file names that contain the .. sequence in the affected GNU Patch versions.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2015-1846

BDU:2017-02046

CVE-2015-1395

MGASA-2015-0068

SUSE-SU-2015:1019-1

USN-2651-1

Affected Products

Alt Linux

Gnu Patch

Suse

Ubuntu

References · 46

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4651 · Security Note
• https://git.savannah.gnu.org/cgit/patch.git/commit/?id=17953b5893f7c9835f0dd2a704ba04e0371d2cbd · Patch
• https://ubuntu.com/security/CVE-2014-9637 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-1395 · Vendor Advisory
• https://savannah.gnu.org/bugs/?44059 · Vendor Advisory
• https://ubuntu.com/security/CVE-2010-4651 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1396 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1396 · Security Note
• http://openwall.com/lists/oss-security/2015/01/27/28 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1184490 · Patch
• https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148953.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1395 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1395 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2651-1 · Vendor Advisory