The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).

dpkg and update-alternatives were updated to 1.16.16 to fix one security issue and severan non-security bugs.

The following vulnerabilities were fixed :

  - CVE-2015-0840: Specially crafted deb packages could have     been used to bypass source package integrity     verification in local installs (boo#926749)

Also contains a number of upstream bugs and improvements.

Jann Horn discovered that the source package integrity verification in dpkg-source can be bypassed via a specially crafted Debian source control file (.dsc). Note that this flaw only affects extraction of local Debian source packages via dpkg-source but not the installation of packages from the Debian archive.

For the oldoldstable distribution (squeeze), this problem has been fixed in version 1.15.12. This also fixes a similar bug discovered by Ansgar Burchardt and a bug in the same area discovered by Roger Leigh.

For the oldstable distribution (wheezy), this problem was fixed in version 1.16.16.

The stable distribution (jessie) was not affected by this problem as it was fixed before release.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix build for all versions, previous try wasn't correct and back with dpkg-perl-libexecdir.patch . Security fix for CVE-2014-8625 and Security fix for CVE-2015-0840

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix build for all versions, previous try wasn't correct and back with dpkg-perl-libexecdir.patch Security fix for CVE-2014-8625 and Security fix for CVE-2015-0840

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix build for all versions, previous try wasn't correct and back with dpkg-perl-libexecdir.patch Revert location of dpkg/parsechangelog .
Security fix for CVE-2014-8625 and Security fix for CVE-2015-0840 Security fix for CVE-2014-8625 and Security fix for CVE-2015-0840

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2566-1 advisory.

    Jann Horn discovered that dpkg incorrectly validated signatures when extracting local source packages. If     a user or an automated system were tricked into unpacking a specially crafted source package, a remote     attacker could bypass signature verification checks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Jann Horn discovered that the source package integrity verification in dpkg-source can be bypassed via a specially crafted Debian source control file (.dsc). Note that this flaw only affects extraction of local Debian source packages via dpkg-source but not the installation of packages from the Debian archive.

ID	Name	Product	Family	Severity
84187	openSUSE Security Update : dpkg / update-alternatives (openSUSE-2015-421)	Nessus	SuSE Local Security Checks	medium
83498	Debian DLA-220-1 : dpkg security update	Nessus	Debian Local Security Checks	medium
83385	Fedora 20 : dpkg-1.16.16-5.fc20 (2015-7342)	Nessus	Fedora Local Security Checks	medium
83384	Fedora 21 : dpkg-1.16.16-5.fc21 (2015-7296)	Nessus	Fedora Local Security Checks	medium
83322	Fedora 22 : dpkg-1.16.16-5.fc22 (2015-6974)	Nessus	Fedora Local Security Checks	medium
82697	Ubuntu 14.04 LTS : dpkg vulnerability (USN-2566-1)	Nessus	Ubuntu Local Security Checks	critical
82670	Debian DSA-3217-1 : dpkg - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-0840

critical

Tenable Plugins

medium

medium

medium

medium

medium

critical

medium