Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.

Update to 1.16.15, fixes: CVE-2014-3864, CVE-2014-3865 , rhbz #1103026 Update to 1.16.14, fixes CVE-2014-0471, rhbz #1092210 .

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.16.15, fixes: CVE-2014-3864, CVE-2014-3865 , rhbz #1103026

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2242-1 advisory.

    It was discovered that dpkg incorrectly handled certain patches when unpacking source packages. If a user     or an automated system were tricked into unpacking a specially crafted source package, a remote attacker     could modify files outside the target unpack directory, leading to a denial of service or potentially     gaining access to the system.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in dpkg that allow file modification through path traversal when unpacking source packages with specially crafted patch files.

This update had been scheduled before the end of security support for the oldstable distribution (squeeze), hence an exception has been made and was released through the security archive. However, no further updates should be expected.

ID	Name	Product	Family	Severity
77066	Fedora 19 : dpkg-1.16.15-1.fc19 (2014-8564)	Nessus	Fedora Local Security Checks	medium
76607	Fedora 20 : dpkg-1.16.15-1.fc20 (2014-7697)	Nessus	Fedora Local Security Checks	medium
74464	Ubuntu 14.04 LTS : dpkg vulnerabilities (USN-2242-1)	Nessus	Ubuntu Local Security Checks	high
74375	Debian DSA-2953-1 : dpkg - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-3864

high

Tenable Plugins

medium

medium

high

medium