Detections
Analytics

Debian DSA-3217-1 : dpkg - security update

medium Nessus Plugin ID 82670

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Jann Horn discovered that the source package integrity verification in dpkg-source can be bypassed via a specially crafted Debian source control file (.dsc). Note that this flaw only affects extraction of local Debian source packages via dpkg-source but not the installation of packages from the Debian archive.

Solution

Upgrade the dpkg packages.

For the stable distribution (wheezy), this problem has been fixed in version 1.16.16. This update also includes non-security changes previously scheduled for the next wheezy point release. See the Debian changelog for details.

See Also

https://packages.debian.org/source/wheezy/dpkg

https://www.debian.org/security/2015/dsa-3217

Plugin Details

Severity: Medium

ID: 82670

File Name: debian_DSA-3217.nasl

Version: 1.5

Type: local

Agent: unix

Published: 4/10/2015

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:dpkg, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 4/9/2015

Reference Information

CVE: CVE-2015-0840

DSA: 3217