debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.

Raphael Geissert discovered that the debdiff.pl tool incorrectly handled shell metacharacters. If a user or automated system were tricked into processing a specially crafted filename, a remote attacker could possibly execute arbitrary code. (CVE-2012-0212)

Raphael Geissert discovered that the dscverify tool incorrectly escaped arguments to external commands. If a user or automated system were tricked into processing specially crafted files, a remote attacker could possibly execute arbitrary code. (CVE-2012-2240)

Raphael Geissert discovered that the dget tool incorrectly performed input validation. If a user or automated system were tricked into processing specially crafted files, a remote attacker could delete arbitrary files. (CVE-2012-2241)

Raphael Geissert discovered that the dget tool incorrectly escaped arguments to external commands. If a user or automated system were tricked into processing specially crafted files, a remote attacker could possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2012-2242)

Jim Meyering discovered that the annotate-output tool incorrectly handled temporary files. A local attacker could use this flaw to alter files being processed by the annotate-output tool. On Ubuntu 11.04 and later, this issue was mitigated by the Yama kernel symlink restrictions. (CVE-2012-3500).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paul Wise discovered that debdiff did not properly sanitize its input when processing .dsc and .changes files. If debdiff processed a crafted file, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-0210)

Raphael Geissert discovered that debdiff did not properly sanitize its input when processing source packages. If debdiff processed an original source tarball, with crafted filenames in the top-level directory, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-0211)

Raphael Geissert discovered that debdiff did not properly sanitize its input when processing filename parameters. If debdiff processed a crafted filename parameter, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-0212).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in debdiff, a script used to compare two Debian packages, which is part of the devscripts package. The following Common Vulnerabilities and Exposures project ids have been assigned to identify them :

  - CVE-2012-0210 :
    Paul Wise discovered that due to insufficient input     sanitising when processing .dsc and .changes files, it     is possible to execute arbitrary code and disclose     system information.

  - CVE-2012-0211 :
    Raphael Geissert discovered that it is possible to     inject or modify arguments of external commands when     processing source packages with specially-named tarballs     in the top-level directory of the .orig tarball,     allowing arbitrary code execution.

  - CVE-2012-0212 :
    Raphael Geissert discovered that it is possible to     inject or modify arguments of external commands when     passing as argument to debdiff a specially-named file,     allowing arbitrary code execution.

ID	Name	Product	Family	Severity
62411	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : devscripts vulnerabilities (USN-1593-1)	Nessus	Ubuntu Local Security Checks	high
57973	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : devscripts vulnerabilities (USN-1366-1)	Nessus	Ubuntu Local Security Checks	high
57963	Debian DSA-2409-1 : devscripts - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2012-0212

critical

Tenable Plugins

high

high

high