Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or full pathname, a related issue to CVE-2010-1679.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - patch: Malicious patch files cause ed to execute arbitrary commands (CVE-2018-1000156)

  - Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote     attackers to create or overwrite arbitrary files via a filename that is specified with a .. (dot dot) or     full pathname, a related issue to CVE-2010-1679. (CVE-2010-4651)

  - An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c     can possibly lead to DoS via a crafted input file. (CVE-2016-10713)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 3 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - patch: directory traversal flaw allows for arbitrary file creation (CVE-2010-4651)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - patch: directory traversal flaw allows for arbitrary file creation (CVE-2010-4651)

  - patch: Double free of memory in pch.c:another_hunk() causes a crash (CVE-2018-6952)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - patch: directory traversal flaw allows for arbitrary file creation (CVE-2010-4651)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This update for patch fixes several issues. These security issues were fixed :

  - CVE-2018-1000156: patch: Malicious patch files cause ed     to execute arbitrary commands (bsc#1088420).

  - CVE-2014-9637: Prevent DoS by remote attackers (memory     consumption and segmentation fault) via a crafted diff     file (bsc#914891).

  - CVE-2016-10713: Prevent out-of-bounds access within     pch_write_line() that could have lead to DoS via a     crafted input file (bsc#1080918).

  - CVE-2010-4651: Fixed a directory traversal bug     (bsc#662957) :

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2651-1 advisory.

    Jakub Wilk discovered that GNU patch did not correctly handle file paths in patch files. An attacker could     specially craft a patch file that could overwrite arbitrary files with the privileges of the user invoking     the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2010-4651)

    Lszl Bszrmnyi discovered that GNU patch did not correctly handle some patch files. An attacker     could specially craft a patch file that could cause a denial of service. (CVE-2014-9637)

    Jakub Wilk discovered that GNU patch did not correctly handle symbolic links in git style patch files. An     attacker could specially craft a patch file that could overwrite arbitrary files with the privileges of     the user invoking the program. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-1196)

    Jakub Wilk discovered that GNU patch did not correctly handle file renames in git style patch files. An     attacker could specially craft a patch file that could overwrite arbitrary files with the privileges of     the user invoking the program. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-1395)

    Jakub Wilk discovered the fix for CVE-2015-1196 was incomplete for GNU patch. An attacker could specially     craft a patch file that could overwrite arbitrary files with the privileges of the user invoking the     program. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-1396)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - Directory traversal vulnerability in dpkg-source in dpkg     before 1.14.31 and 1.15.x allows user-assisted remote     attackers to modify arbitrary files via directory     traversal sequences in a patch for a source-format 3.0     package. (CVE-2010-1679)

  - Directory traversal vulnerability in util.c in GNU patch     2.6.1 and earlier allows user-assisted remote attackers     to create or overwrite arbitrary files via a filename     that is specified with a .. (dot dot) or full pathname,     a related issue to CVE-2010-1679. (CVE-2010-4651)

New patch packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components :

  - App Store
  - ATS
  - Certificate Trust Policy
  - CoreFoundation
  - CoreGraphics
  - FTP Server
  - ImageIO
  - International Components for Unicode
  - Kernel
  - Libsystem
  - libxslt
  - MobileMe
  - MySQL
  - OpenSSL
  - patch
  - QuickLook
  - QuickTime
  - Samba
  - servermgrd
  - subversion

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-004 applied. This update contains security- related fixes for the following components :

  - AirPort
  - App Store
  - ColorSync
  - CoreGraphics
  - ImageIO
  - Libsystem
  - libxslt
  - MySQL
  - patch
  - Samba
  - servermgrd
  - subversion

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion
IAVA Reference : 2011-A-0160
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion

Applied fix so that malicious patches cannot create files above the current directory (CVE-2010-4651).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198398	RHEL 5 : patch (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198382	RHEL 3 : patch (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198379	RHEL 6 : patch (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198325	RHEL 4 : patch (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
109599	SUSE SLES11 Security Update : patch (SUSE-SU-2018:1162-1)	Nessus	SuSE Local Security Checks	high
84339	Ubuntu 14.04 LTS : GNU patch vulnerabilities (USN-2651-1)	Nessus	Ubuntu Local Security Checks	high
80626	Oracle Solaris Third-Party Patch Update : gnu-patch (multiple_vulnerabilities_in_gnu_patch)	Nessus	Solaris Local Security Checks	medium
62080	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : patch (SSA:2012-257-02)	Nessus	Slackware Local Security Checks	medium
55416	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
55415	Mac OS X Multiple Vulnerabilities (Security Update 2011-004)	Nessus	MacOS X Local Security Checks	high
800790	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5968	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
52570	Fedora 14 : patch-2.6.1-8.fc14 (2011-1272)	Nessus	Fedora Local Security Checks	medium
52569	Fedora 13 : patch-2.6.1-8.fc13 (2011-1269)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-4651

high

Tenable Plugins

high

high

high

high

high

high

medium

medium

critical

high

high

critical

medium

medium